0to1 DevHub is a landing page plus secure waitlist backend for the 0to1 startup program. The frontend is a Next.js app with a high-fidelity 0to1-style landing experience, smooth scrolling, motion polish, a smoke/liquid hero feel, and an expanded waitlist form. The backend is an Express API that validates submissions and writes them to Supabase using a server-only service role key.
This GitHub repository root is the codes folder.
.
├── frontend/ # Next.js App Router frontend
├── backend/ # Express + TypeScript API
├── .gsd/ # Project-local GSD state and verification notes
├── DEPLOYMENT.md # Production deployment runbook
├── render.yaml # Render backend blueprint
├── package.json # npm workspaces root
└── README.md
Shared toolkit folders outside this repo are reference-only and must not be edited.
- Frontend: Next.js 16, React 18, Tailwind CSS, Lenis, Anime.js, Three.js, Lucide icons
- Backend: Express 5, TypeScript, Zod, Helmet, CORS, Supabase JS
- Database: Supabase Postgres
- Responsive 0to1 landing page
- White hero with smoke/liquid visual treatment
- Dark glass sections with neon aqua accents
- Smooth scrolling and reduced-motion-safe animations
- Expanded waitlist panel:
- Full Name
- Contact Number
- College Name
- City
- Course Background
- Secure backend waitlist API
- Strict schema validation with unknown-field rejection
- Rate limiting on public endpoints
- Server-only Supabase writes
- Duplicate email handling
- Node.js
- npm
- A Supabase project
Install dependencies from this repo root:
npm installCreate local env files from the examples. Do not commit real secrets.
Frontend:
cp frontend/.env.example frontend/.env.localExpected frontend values:
NEXT_PUBLIC_API_URL="http://localhost:4000"
NEXT_PUBLIC_APP_URL="http://localhost:3000"Backend:
cp backend/.env.example backend/.env.localExpected backend values:
SUPABASE_URL="https://YOUR_PROJECT_ID.supabase.co"
SUPABASE_SERVICE_ROLE_KEY="your-server-only-service-role-key"
IP_HASH_SALT="replace-with-a-long-random-secret"
FRONTEND_ORIGIN="http://localhost:3000"
TRUST_PROXY="false"
PORT="4000"Security notes:
SUPABASE_SERVICE_ROLE_KEYmust stay backend-only.- Only
NEXT_PUBLIC_*values are exposed to the browser by Next.js. - Rotate any credentials that were pasted into chat before deployment.
Open your Supabase project, go to SQL Editor, and run the schema from:
backend/supabase/schema.sql
The current schema creates and updates the public.waitlist table, enables Row Level Security, blocks anon select/insert access, and reloads the PostgREST schema cache.
Core table fields:
id
email
full_name
contact_number
college_name
city
course_background
created_at
source
ip_hash
The frontend does not write directly to Supabase. All waitlist writes go through the Express API using the server-side service role key.
Run both apps:
npm run devOr run them separately:
npm run dev:frontend
npm run dev:backendLocal URLs:
Frontend: http://localhost:3000
Backend health: http://localhost:4000/health
Opening http://localhost:4000/ returns 404_NOT_FOUND. That is expected because the backend has no homepage route.
Deployment uses Vercel for the frontend, Render for the backend, and the existing Supabase project for the database.
Follow the production runbook in DEPLOYMENT.md. Keep all production secrets in Vercel/Render environment variables only.
Returns:
{
"success": true,
"status": "ok",
"service": "0to1-backend"
}Accepts only this strict JSON shape:
{
"fullName": "Student Name",
"contactNumber": "+91 9876543210",
"email": "student@example.com",
"collegeName": "College Name",
"city": "Mumbai",
"courseBackground": "BTech AI & DS"
}Expected responses:
201 CREATED Waitlist row created
409 DUPLICATE_EMAIL Email already exists
422 VALIDATION_ERROR Invalid, missing, or unexpected fields
429 RATE_LIMITED Too many requests
400 INVALID_JSON Malformed JSON or wrong content type
405 METHOD_NOT_ALLOWED Non-POST waitlist request
404 NOT_FOUND Unknown route
500 SERVER_ERROR Generic server-side failure
Run static checks:
npm run lint
npm run type-check
npm run build
npm audit --audit-level=lowBackend smoke test:
curl http://localhost:4000/healthExample waitlist request:
curl -i -X POST http://localhost:4000/api/waitlist \
-H "Content-Type: application/json" \
-d "{\"fullName\":\"Test User\",\"contactNumber\":\"+91 9876543210\",\"email\":\"test-user@example.com\",\"collegeName\":\"DevHub Institute\",\"city\":\"Mumbai\",\"courseBackground\":\"BTech Computer Science\"}"Implemented:
- Helmet security headers
x-powered-bydisabled- Strict CORS using
FRONTEND_ORIGIN - JSON body size limit
- Global and route-level rate limiting
Retry-Afterfor rate-limited responses- Strict Zod schema validation
- Unknown-field rejection
- Server-only Supabase service role client
persistSession: false,autoRefreshToken: false,detectSessionInUrl: false- IP hashing with
IP_HASH_SALT - Generic server errors with no secret leakage
Before deployment:
- Rotate any credentials that were shared during development.
- Use production secrets from the deployment environment, not source files.
- Re-run the verification commands and security review.
- Consider Redis/Upstash-backed rate limiting if running multiple backend instances.
Check that the backend is running:
curl http://localhost:4000/healthIf it cannot connect, start the backend:
npm run dev:backendThat is expected. Use:
http://localhost:4000/health
Run the latest SQL from:
backend/supabase/schema.sql
Then run:
NOTIFY pgrst, 'reload schema';That is expected. The email column is unique so each email can join once.
Project-local evidence lives in:
.gsd/STATE.md
.gsd/VERIFICATION.md
security-reports/security-report-2026-05-10.md
verification-screenshots/