Every SaaS starts with one clever idea and a mountain of undifferentiated plumbing standing between that idea and a paying customer. The idea is yours. The plumbing is the same seven things every SaaS has rebuilt, badly, for fifteen years. In 2026, rebuilding them from scratch isn't diligence — it's the most expensive mistake a new software business can make. Here's the list, why each one quietly eats months, and why you should never write them yourself.
It looks like a weekend. It never is. Registration, login, password reset, email verification, session management, refresh tokens, social login, rate limiting, lockout on brute force, and the security discipline to keep all of it patched forever. Auth is the front door to everything you'll ever store, which means a bug here isn't a bug — it's a breach. It's also completely undifferentiated: no customer ever chose a product because its login was special. Building your own auth is spending your scarcest early weeks on the part of the product that, done perfectly, is invisible.
The moment you have more than one kind of user — an admin, a member, a billing owner — you need real access control. Not an if user.is_admin scattered through your code, but a coherent system of roles and permissions you can reason about and audit. Teams that skip this end up with authorization logic smeared across every endpoint, which is exactly how data leaks: one route forgets the check. Getting RBAC right is genuinely hard, genuinely important, and genuinely not your product.
This is where most "I'll just build it" plans go to die. Recurring billing means plans, trials, upgrades, downgrades, proration, failed-payment retries (dunning), refunds, invoices that are legally compliant in every jurisdiction you sell to, and tax — VAT, sales tax, the lot — calculated correctly or you're personally liable. Each of those is a small project. Together they're a department. And a billing bug doesn't just annoy customers; it charges the wrong amount, which is the fastest way to lose trust and attract regulators.
Here's the one almost everyone forgets exists until it breaks. Billing tells you someone paid. Entitlement is the machinery that turns "they paid for the Pro plan" into "they can actually see the Pro features" — and, just as importantly, turns "their card failed and they lapsed" into "that access is now gone," automatically, without a human touching anything. Get this wrong in one direction and you give paying features away to people who cancelled. Get it wrong in the other and you lock out customers who paid. Entitlement is the seam between money and product, and it's fiddly precisely because it has to be exactly right in both directions, forever.
Every SaaS needs a place where you — not your customers — manage users, subscriptions, refunds, content and configuration. Founders always underestimate this, because it isn't customer-facing and doesn't demo well. Then support requests arrive, and you're editing the production database by hand at midnight because there's no admin screen to change a plan or issue a refund. A proper backoffice is weeks of unglamorous CRUD that you will build eventually — the only question is whether you build it before or after it hurts.
Your customers live on their phones. "We'll do mobile later" increasingly means "we'll lose the customers who wanted mobile now." But a native iOS and Android app is traditionally a whole second and third project — a different language, a different team, a separate build and release pipeline, all re-implementing the logic your web app already has. The cost of mobile is usually not the app; it's maintaining three copies of the same product.
In 2026 a SaaS without a language model wired in already feels dated, and increasingly the thing calling your software isn't a person at all — it's an AI agent acting for one. That means two new obligations: a place to configure AI features without scattering API keys through your code, and a machine-callable interface (the Model Context Protocol is becoming the standard) so agents can use your product safely. Both are real engineering, and both are now table stakes rather than a differentiator.
None of those seven is your product. Every one of them is mandatory. And together they're the majority of the engineering in any serious SaaS — the reason the gap between "great idea" and "first paying customer" is measured in quarters, not weeks. You will spend most of your runway building the parts of your product that are identical to everyone else's, and only what's left on the part that's actually yours.
That's the maths that makes building from scratch a mistake. Not because it's impossible — because it's a waste of the one resource an early software business can't buy more of: time before the money runs out.
This is exactly the gap VBWD is built to close. It's a self-hosted, source-available full-stack SDK that ships all seven of these as core capabilities: authentication and accounts; RBAC with roles, permissions and access levels; subscription billing with invoicing and tax; automatic entitlement that flips access with subscription status; an admin backoffice you extend rather than build; three frontends (web in Vue/TypeScript, plus iOS and Android SDKs) from one backend; and an AI layer with a central LLM connection and a built-in MCP server so agents can call your product out of the box.
You extend it through plugins over an agnostic core — so the clever idea that is actually your product lives in your plugin, and the seven undifferentiated things are simply already there. The honest caveats: it's self-hosted, so you run the server rather than renting a SaaS, and a platform that does this much has a shape to learn. But you own the whole stack, there's no per-seat platform tax, and it's free for commercial use below a defined revenue threshold — which is the right price for the foundation of a business you haven't monetised yet.
The clever idea is the reason your SaaS exists. The other seven things are the reason it takes so long to ship. Start with them already built, and spend your runway on the part only you can write.
VBWD is a self-hosted, source-available platform for building subscription products, marketplaces, and AI-powered apps. Explore it further: