What's new in ShipRust

More dependable local tests

Parallel signup tests now keep their emails and verification codes separate, preventing unrelated tests from causing false failures. Mutation checks also include newly added Rust files before you commit them. You can focus fuzz testing on selected inputs while keeping the same seed checks and safety limits.

Sign in with Google

Your app can now offer Sign in with Google. People with a Gmail or Google Workspace address create an account or sign in with one click, and anyone can connect Google to the account they already have from their account settings. Accounts created with Google have no password: they confirm sensitive changes with Google instead, and two-factor codes still apply. Add your own Google sign-in credentials after downloading; until then the button stays hidden and nothing else changes.

Ready to share and discover

Your homepage, legal pages, blog and guides now have distinct search descriptions and social preview images. Cards use your project name automatically, even without a blog or docs. Search engines can find the sitemap through robots.txt, while account pages stay out of search results.

A shorter index for AI assistants

Your /llms.txt now helps AI assistants find the right guide through a concise list of links. The complete documentation is available at /llms-full.txt, linked from the index. Both update automatically when you edit your guides, and the index is checked to stay below 30,000 characters.

Safer worker shutdown

Workers now leave waiting jobs for the next worker when shutdown arrives as capacity becomes available. Jobs already running still finish within the configured shutdown period.

Cleanup after failed uploads

Failed uploads to local storage now remove their temporary file when possible, while preserving existing files. You can retry once the storage problem is resolved.

Help AI understand your website

Your homepage, blog, guides and legal pages now include structured information that helps search engines and AI tools identify your product and its content. It uses your project name and website address automatically, with a place to add your own pricing and official profiles.

More reliable background-job tests

The background-job recovery and shutdown tests now wait for test jobs explicitly, avoiding false failures when a build machine is busy.

Your website, readable by AI agents

AI agents can now request your homepage, blog, guides and legal pages as Markdown at the same addresses people visit. Browsers still see the full website. Both versions come from the same content, so there is no extra copy to keep up to date.

Easier API discovery for AI agents

Projects with the API enabled now publish their API description at /openapi.json, a standard place for agents and integration tools to look. The existing /api/v1/openapi.json address and interactive API docs continue to work.

Tests that check your tests

Every project now includes mutation testing. On each pull request, CI makes small deliberate changes to the Rust code you changed and checks that your tests catch them. If a change slips through, CI fails and saves a report showing where another test may be needed. You can also run a full audit locally or from GitHub Actions.

Project names with quotes and backslashes

Project downloads now escape names correctly inside code and configuration files, so names containing quotes or backslashes no longer produce broken projects.

Automatic testing with unexpected inputs

Every new project includes tests that try malformed and unexpected inputs against its input handling, passkey checks and AI-tool protocol. They run automatically on pull requests, save failures for replay, and can run longer on your computer to search for harder-to-find bugs.

See which decisions your tests miss

Every new project now includes automatic branch coverage reports. Each pull request shows which outcomes your tests exercise and which still need attention, with a downloadable report that points to the code. It runs with your chosen project features and needs no extra service or account.

Sign up locally without an email provider

A new project now lets you create your first account as soon as it runs on your computer. Until you connect Mailgun, the app prints each email, including the sign-up code, in the terminal. Copy the code into the browser to finish. On a live HTTPS site the app will not start until Mailgun is set up, so codes never end up in production logs.

Dependency security checks

Every pull request now checks your project's dependencies against the RustSec vulnerability database, and fails if one has a known security hole, is no longer maintained, or uses a license that would oblige you to publish your own code. Dependabot opens a weekly pull request with dependency updates, which your CI tests before you merge.

Tests work with multi-word project names

Fix the bundled two-factor authentication test for project names containing spaces or punctuation. The authenticator link already handled these names correctly; the test now checks the encoded link too.

Accounts are optional

New "Include accounts" option, on by default. Turn it off and your project is a public website with no sign-up, sign-in or dashboard: a "Get in touch" button takes their place, and the Terms and Privacy pages drop their account sections. The API, MCP, file storage, Stripe and Qdrant options build on accounts, so they come with them.

No unsafe code

Every crate in a generated project forbids unsafe Rust, so the build fails if it ever appears. Your app keeps Rust's memory-safety guarantees end to end.

/llms.txt built from your docs

Projects with docs now serve /llms.txt: your app's name and description, an index of every published guide, then each guide in full. AI assistants can read your whole documentation in one request. It is built at startup from the same files as the HTML docs, so new guides appear on their own and drafts stay out.

OpenAPI document and Swagger UI

With the API option, projects serve an OpenAPI 3.1 document at /api/v1/openapi.json and interactive Swagger UI at /api/v1/docs. Both are generated from the code, so a new endpoint is documented the moment it is registered.

Terms of Service and Privacy Policy

Every project ships /terms and /privacy, linked from the footer and listed in the sitemap. Fill in your company, contact email and governing law in one file. The privacy policy only mentions Stripe, PostHog, Sentry, file storage and session replay when you selected them.

Social cards for every page

Every page now has a description, Open Graph tags and a large X card, so shared links look right. Each blog post and docs page gets its own generated 1200×630 preview image, drawn in pure Rust at startup and served with permanent caching.

A landing page that sells

The placeholder homepage is replaced with full-height screens that each carry one idea, the same structure shiprust.com uses. The placeholder copy explains the rules it follows, and the project's AGENTS.md gives your coding agent the same rules.

Fixes

• A fresh project now compiles on its first run, before the database has any tables.
• Projects with very long names pass cargo fmt --check.

Two-factor authentication

Users can protect their account with an authenticator app (TOTP) and single-use recovery codes. Setup is a QR code on the settings page. No configuration and nothing to turn on.

File storage and profile pictures

New storage option, on by default: upload files to any S3-compatible bucket (Cloudflare R2, AWS S3, MinIO, Backblaze B2) or to local disk, with no SDK. Profile pictures in account settings are the worked example, and a guide shows how to store other files.

MCP server

New mcp option, on by default with the API: your users can connect Claude, Cursor and other AI assistants to your product at /mcp with their API keys. It ships with a get_account tool and a guide for adding your own tools.

Qdrant vector search

New optional qdrant feature connects your app to a Qdrant vector database for semantic search and AI features. Every read and write is scoped to one user, and deleting an account removes that user's vectors.

Your brand, not ours

Generated code now carries your product's name everywhere, including emails, the admin panel and crate names. Only the license and an attribution line mention ShipRust.

Fixes

• Markdown tables render in docs pages.

JSON API with personal API keys

New API option, on by default: users create and revoke personal API keys in their settings, and /api/v1 gives you a place to add endpoints, with JSON errors and a guide.

Background jobs

A durable job queue stored in your own Postgres database, with no Redis or extra service. Jobs survive restarts, retry with backoff and can run in a separate worker process. A welcome email is the worked example.

Worker app in the CapRover deploy

The generated CapRover workflow can deploy a second worker app from the same image, so background jobs run apart from web traffic. Add one repository secret to turn it on.

Passkeys

Users can sign in with a passkey (Face ID, Touch ID, Windows Hello or a security key) instead of a password, including from the email field's autofill.

Email verification at sign-up

New accounts confirm their email address with a one-time code when they sign up.

Admin panel

A read-only user overview at /admin, with admin access granted or revoked from the command line. Admins also get complimentary access to paid features.

Automatic IndexNow

When you deploy, new and changed pages are submitted to Bing and other IndexNow search engines automatically, so they are indexed sooner.

Stripe billing

New optional Stripe integration: hosted Checkout for subscriptions and one-time purchases, the customer portal, verified webhooks and a guide explaining pricing tiers and paid access.

Sentry monitoring

New Sentry option, on by default. Error reporting, performance tracing, logs, metrics and session replay can each be switched on or off.

Account settings

Signed-in users get an account menu and a settings page to update their profile and email, pick a light or dark theme and delete their account.

Setup guides

Projects ship guides for Docker, CapRover, PostHog, Sentry and the blog, so you and your team have instructions from day one.

Optional blog

A Markdown blog with an RSS feed, on by default. Write a post as a Markdown file and it is published on the next deploy.

Optional docs

A documentation section built from Markdown files, on by default, with welcome and account guides to start from.

PostHog analytics

New PostHog option: product analytics, error tracking and web vitals in the browser, plus server-side events, logs and traces.

Built for search engines and AI agents

Projects now include an XML sitemap, homepage content that AI agents can read, and Markdown 404 pages for agents that ask for Markdown.

Faster and leaner

• Expired sessions are cleaned up automatically.
• Password hashing runs off the request threads with a cap on concurrent work, so a burst of sign-ins cannot stall the site.
• Docker builds cache compiled dependencies, so redeploys rebuild only your code.
• Fewer dependencies and less unused code.

First release

ShipRust's foundation: a Rust web app with Axum, server-rendered pages with Maud and Postgres with compile-time checked SQL, built as one small binary. It includes email and password accounts with secure server-side sessions, a landing page, sign-up, sign-in and a dashboard, end-to-end tests against a real database, CI, a Dockerfile and docker-compose.

One-click CapRover deploys

Choose CapRover as your host and the project includes a GitHub Actions workflow that builds your image, deploys it and checks that the new version is live.