Self-hosted SaaS form builder: a drag-and-drop editor with 12+ field types, a gallery of 50 starter templates, shareable and embeddable forms, anonymous submissions with full metadata capture, per-form analytics funnels, a REST API with signed webhooks, teams, and three-tier plan gating — all on your own MongoDB.
Hosted form builders keep your submissions on someone else's infrastructure and meter every feature behind pricing tiers. The goal was a builder that could be self-hosted end-to-end — data stays on your own MongoDB — while still offering real SaaS mechanics: plan gating, analytics, an API, and webhooks.
The Solution
A Next.js 16 platform with a DnD Kit editor (12+ field types, multi-step, 11 themes) and a seeded gallery of 50 starter templates, public and embed surfaces with per-surface CSP headers, anonymous submissions with rate limiting and full metadata capture, per-form conversion funnels with Gemini insights, a read-only v1 API with hashed keys, HMAC-signed webhooks hardened against SSRF, teams and collaborators, and three plan tiers enforced entirely server-side.
Per-form analytics: views → starts → completions funnel, geography/device/UTM breakdowns, AI insights via Gemini
REST API v1 with SHA-256-hashed keys (show-once, max 5, auto-deactivated on plan downgrade) and in-app API docs
HMAC-signed webhooks with async delivery, per-endpoint secrets, delivery logs, and SSRF protection
Teams, per-form collaborators, and invite links
Three-tier plan gating enforced server-side with usage counters and reconciliation
Scheduling, version history with restore, CSV export, and an admin dashboard
What I Learned
Designing SaaS plan gating — server-side enforcement vs. client UI gates
Signing and delivering webhooks asynchronously (HMAC-SHA256, timeouts, delivery logs)
API key security: SHA-256 hashing, show-once flow, revocation
Anonymous rate limiting and anti-spam without hurting real submissions
SSRF hardening for outbound webhooks — HTTPS-only, private/internal hosts blocked
Per-surface security headers — embeds frameable, public forms locked
Multi-step drag-and-drop editor state with DnD Kit
Idempotent seed scripts — repair drifted data in place instead of wiping
Usage metering with database reconciliation to keep counters honest
Need Something Like This?
I Build Reliable Products Without the Stress.
From planning and architecture to polished delivery, I can turn your idea into a production-ready web app with intuitive UX, strong performance, and zero unnecessary complexity for you.