marketaiguide
bullettrain.co

Bullet Train

An MIT-licensed Ruby on Rails SaaS template built on Rails 8, providing Devise authentication, teams with role-based permissions, a Stripe billing engine, a REST API and webhooks.

Free and open source (MIT), with optional project sponsorship. Open source Named by Claude in 1 list this week

How Claude rates Bullet Train.

Each score below is the model's own, on the rubric it wrote for that list, from what it already knows about Bullet Train. Nothing here is edited by us.

The best open-source SaaS starter kits

#1 this week, scoring 8.3 out of 10. Best for Rails developers building sophisticated SaaS products who value open-source and want a mature, battle-tested framework.

Tech stack & architecture 8
Modern Rails 7 with Hotwire, Tailwind, and PostgreSQL represents a mature, productive stack for those who prefer Rails.
Feature completeness 9
Exceptionally complete with teams, permissions, API, webhooks, and sophisticated CRUD scaffolding built in.
Documentation & support 8
Excellent documentation with guides, screencasts, and an active community, though Rails knowledge is required.
Customization ease 7
Rails conventions make customization straightforward for Rails developers, but the comprehensiveness requires learning.
License & pricing value 10
MIT licensed and completely free with no restrictions represents exceptional value.

Rank by week:

#3#3#1

Want a better score? How to improve your AEO.

Security headers

What Bullet Train's website sends to your browser.

Scanned 2026-08-25. Grade headers F, scoring 25 out of 100.

− No Content-Security-Policy, so no defence in depth against cross-site scripting
+ Strict-Transport-Security is set
− No X-Content-Type-Options, so MIME sniffing is not disabled
− No X-Frame-Options and no CSP frame-ancestors, so clickjacking is possible
− No Referrer-Policy, so full URLs may leak to third parties
− No Permissions-Policy, so powerful browser features are not restricted
− No Cross-Origin-Opener-Policy
− No Cross-Origin-Resource-Policy
+ No server-version or X-Powered-By disclosure

This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.

Visit Bullet Train