SaaS / Branchen-DX —
von der Architektur bis zur Infrastruktur,
im Alleingang umgesetzt

An indie SaaS portfolio for re-validating the architecture, SEO, and payments patterns honed in client work against my own products. Several services run under one brand, with shared foundations (auth, billing, AI Gateway) in a hexagonal monorepo — an experiment in an operating model where a new app can be added in a matter of days.

• A Next.js 16 + Turborepo monorepo running several SaaS products from one place
• Centralized token-cost control via an AI Gateway + prompt cache
• Automatic Japanese consumption-tax calculation and qualified-invoice issuance with Stripe Tax
• A marketing foundation with programmatic SEO / GEO (llms.txt) as standard

The security-implementation patterns honed across client and product work, crystallized into a drop-in OSS + CLI. A single middleware file and typed env automate the horizontal controls (headers/CSP, rate limiting, CSRF, secrets hygiene), while it detects and flags the vertical risks a library can't fix (authorization/IDOR, Supabase RLS misconfigurations) via taint analysis and SQL validation. MIT-licensed.

• One middleware file + typed env automate the horizontal controls vibe coding misses
• Intraprocedural taint analysis detects SQLi / SSRF / IDOR with source→sink traces
• Validates RLS / SQL in supabase/migrations and correlates with code to confirm exposure
• Safe auto-fixes + SARIF for GitHub code scanning (only high-confidence findings block CI)

53 articles × 7 languages — 371 MDX files — arranged as a typed content graph of 3 pillars and 50 clusters. It was designed for AI answer engines before human search engines: it serves an llms.txt, publishes a machine-readable pricing dataset under CC BY 4.0, and names 10 AI crawlers in an allowlist. That allowlist is verified by a test that fetches the *deployed* production robots.txt, not the one in the repo.

• Per-article hreflang computed from the set of translations that actually exist, so no missing locale is ever advertised
• A CC BY 4.0 machine-readable dataset published with Dataset structured data, built to be cited
• A deploy-time test that checks the 10-crawler allowlist against production's real robots.txt
• Search-Console queries classified as answer-engine fan-out vs. human, feeding an editorial backlog automatically

A VLM extracts structure from a photographed palm, and a deterministic Four Pillars engine computes the chart. The LLM is permitted to do one thing: turn those facts into prose. Every generated section must cite evidence references, which are machine-checked against a canonical vocabulary — prose citing a feature that does not exist fails validation and is regenerated. Hallucination is excluded structurally rather than by policy. Palm images exist only for the duration of the request and are never persisted. Japanese-language product.

• Three-layer split — VLM extraction, deterministic engine, LLM for prose only — keeps the model off the facts
• Solar-term data verified against the National Astronomical Observatory of Japan (1940–2036, to the minute)
• 100% coverage enforced as a threshold on every workspace; 7 CI workflows including CodeQL, Trivy, OSV and SBOM
• A per-call AI cost ledger that snapshots unit prices, so a later price change cannot rewrite past COGS