// the find
sahat/hackathon-starter
A boilerplate for Node.js web applications
A Node.js/Express starter template aimed at hackathon teams who need auth and common API integrations wired up fast. Covers local auth, OAuth2 with 8+ providers, WebAuthn/passkeys, TOTP 2FA, and a collection of API examples. It's been alive since 2014 and is still actively maintained.
The auth layer is genuinely complete — local passwords, passwordless, passkeys, TOTP 2FA, multi-provider OAuth2, account linking, and token revocation are all there and wired together. That's weeks of work at a hackathon. The test suite is real: Playwright e2e tests, fixture-based unit tests for external API calls, not just a couple of smoke tests. The dependency list is current — Bootstrap 5.3, Node LTS 24, bcrypt via @node-rs. It was pushed yesterday, which for a 10-year-old project is a strong maintenance signal.
MongoDB is baked in at every layer — sessions, models, the AI agent checkpointing — so if you want Postgres or SQLite you're not adapting this, you're rewriting it. The Pug templating is a liability for any team that hasn't touched it before; a 2025 hackathon team expecting React or even plain HTML will lose hours fighting the whitespace-sensitive syntax. The AI examples are built on LangChain with a half-dozen @langchain/* packages, which is a lot of abstraction for toy demos that most teams will delete and replace anyway. The project structure puts everything in a single app.js with no logical separation — fine at hour zero but it trains bad habits and becomes painful once the codebase grows past a weekend.