You open the last project and start pasting.
Auth. File storage. Email. You wrote them already. Writing JWT refresh from scratch a sixth time is worse than copying it.
What actually goes wrong
Every project starts by harvesting the last one: the auth handlers, the upload pipeline, the mailer, the middleware stack. It is faster than writing them again and it is how a bug travels. The fix you made in project four is not in projects one, two and three, and nobody remembers which ones are missing it.
The copy also arrives without its reasons. The rate limit is there, the comment explaining why it is sixty seconds is not, so the next person tunes it to something that looks nicer.
What Grit does about it
- A new project has authentication, sessions, roles, uploads, mail, jobs, caching and the audit chain already in it, as framework code rather than as a starter template.
- They are upgraded by a command, so a fix made this month reaches a project started last year.
- None of it is opt-in. An opt-in security feature is a security feature most projects do not have.
The commands
grit new billing
grit upgrade
What it does not do
An upgrade cannot touch a file you edited: it reports it instead. The more framework code you rewrite, the more of the upgrade becomes a manual merge, which is the price of owning the code outright.