AI Micro-SaaS
Small, complete SaaS products built around a model: chat interfaces, generation tools, retrieval pipelines and the billing and auth plumbing that turns one into a business.
Every package here was unpacked and its source analysed for malware, prompt-injection payloads, build failures and copied work before it could be listed.
Prompt Injection Sanitiser
A heuristic TypeScript filter for untrusted text on its way into an LLM prompt. It scores text against 35 rules covering instruction-override phrasing, chat-template token smuggling, fence escapes, invisible Unicode, Markdown/HTML exfiltration beacons, tool-call mimicry and encoded payloads, then conservatively rewrites the mechanical parts and fences the result with a random nonce. Ships a zero-dependency CLI (`prompt-injection-sanitiser scan <file|->`) with JSON output and a configurable failing exit code, so the same rules can run in CI. It is defence-in-depth, not a security boundary: it is heuristic, it has not been audited, and it does not prevent prompt injection. Zero runtime dependencies, ships ESM + CJS + type declarations.
RAG Vector Search Starter for Next.js
A Next.js 16 App Router starter for semantic search over your own documents. Embeddings are produced on-device by a MiniLM sentence-transformer through Transformers.js, and vectors are stored in an in-process index persisted to a JSON file, so it runs with no API key and no database. Both layers sit behind interfaces with a second implementation each: an OpenAI-compatible HTTP embedding provider (with configurable retry and backoff) and a Postgres/pgvector store with an included migration. Ships an ingestion pipeline (txt/md loader, recursive character chunker with overlap, batch embedding), validated /api/ingest and /api/search route handlers, a search UI with scores and highlighted matches, a CLI ingester, and sample documents. Both optional backends come with a harness so a buyer can exercise them without paying for anything: a mock OpenAI-compatible embeddings server that the provider's integration tests drive over real HTTP, and a docker-compose pgvector service behind a one-command `npm run verify:pgvector` round trip. The README states plainly which adapters have been executed and which have not.