Rullst is an opinionated, developer-first full-stack web framework for Rust, obsessively designed for Emotional Productivity and Security. It solves the biggest problem in the Rust web ecosystem: the high barrier of entry. With Rullst, you spend your energy building your business, not fighting borrow checkers and manual routing setups.

Unlike other frameworks, Rullst strives to be simultaneously simple and complete, with a relentless focus on security and developer experience (DX).

The origins of this philosophy can be traced back to the very creation of the Rust programming language. The story goes that Graydon Hoare, the original creator of Rust, lived in an apartment building with an elevator that kept crashing due to software bugs in its underlying C/C++ code. Frustrated by having to climb the stairs because of memory safety vulnerabilities, he set out to create a language that was incredibly fast, yet guaranteed memory safety by design—so that developers could build things that "just worked" without fear.

Rullst was forged with this exact mindset. We believe that web development shouldn't be a constant struggle against the framework, the language, or runtime bugs. Rullst is built for those who want to build with ease and safety, harnessing the raw speed and resource efficiency of Rust.

1. Simple yet Complete: We solve the hardest web development problems out-of-the-box securely (routing, auth, ORM, background jobs, hot-reloading), without sacrificing simplicity or completeness. You shouldn't have to piece together 15 different micro-libraries just to build a secure SaaS.

2. Built for Humans and AIs: Rullst is architected to be highly legible and free of runtime "magic". By heavily utilizing static dispatch and compile-time guarantees, the codebase is transparent. This empowers both human developers and AI coding agents to collaborate and build production-ready systems rapidly, even without deep prior framework knowledge.

Rullst is not just a tool; it is a commitment to Emotional Productivity. We take care of the boilerplate and the security pitfalls so you can focus entirely on creating value.

We've rewritten our entire documentation from scratch into a beautiful, high-performance website. Discover everything Rullst can do, read the benchmarks, and master the framework:

👉 Explore the Official Website & Docs

💬 Join the Community on Discord

Found a bug? Report an Issue

Rullst is built with a "Zero-Panic Policy" and tested against the most rigorous standards in the industry.
Our continuous pipeline guarantees absolute safety for production edge infrastructure:

Security Audit	Status	Description
OSSF Scorecard		Supply-chain security & best practices
Codecov		Strict code coverage enforcement
OpenSSF		Open source security standards
Matrix DB Tests		Dockerized PostgreSQL & MySQL integration tests
Continuous Fuzzing		Fuzzing against edge cases & panics
Property Testing		Validating complex logic against edge cases
CodeQL SAST		Advanced semantic code analysis
OWASP ZAP DAST		Dynamic vulnerability scanning
Cargo Deny		Banning unmaintained/vulnerable crates
Cargo Audit		Continuous scanning for crate vulnerabilities
Cargo SemVer		Strict SemVer API breakage checks
Cargo Machete		Detecting unused and bloated dependencies
Benchmark CI		Continuous performance regression testing
Snapshot Testing		UI & Macro structural regression testing
Spellcheck CI		Automated typo detection across docs and code
Clippy Lints		Strict compiler & style linting
Unsafe Policy		100% memory safe. No unsafe code blocks
Miri UB Detection		Detecting Undefined Behavior and memory leaks
Kani Verifier		Automated reasoning and formal verification
Mutation Testing		Mutation testing for test suite robustness
Architecture Linter		Enforcing architectural boundaries
SLSA Level 3		Supply-chain Levels for Software Artifacts
Panic Policy		Graceful error handling across the framework
Secret Scanning		Automated CI prevention of leaked credentials
no_std Build Check		Validates rullst-iot compiles on STM32, ESP32-C3, Cortex-M bare-metal targets
OTA Signature Verification		Ed25519 cryptographic integrity check on all OTA firmware updates
PQC Compliance Audit		Weekly NIST ML-KEM / Kyber & HSM compliance audit (unsafe-free cryptographic modules)
MSRV		Minimum Supported Rust Version

📖 Read the detailed breakdown of all our CI/CD Security Workflows here

Rullst's "Zero-Cost Abstraction" architecture provides full-stack productivity without sacrificing bare-metal speed:

• SSR HTML5 Rendering: Zero-bundle static string rendering avoiding Virtual DOM allocations.
• Macro Routing (routes!): Direct compile-time static dispatch powered by Axum and Tokio.
• HtmlSanitizer & XSS Shield: High-speed Ammonia AST payload filtering.
• RbacGuard Role & Ownership BOLA: Zero-allocation bitflags security authorization.
• Vault In-Memory Zeroization: Cryptographic drop memory wiping preventing cold-boot RAM inspection.
• Stripe Webhook Signature Verification: Constant-time HMAC-SHA256 protecting against timing attacks.
• Passkey WebAuthn Challenge Parser: High-performance FIDO2 passwordless auth parsing.
• Zero-Trust Device Fingerprinting: Subnet-aware session binding with zero runtime overhead.
• AI Guardrail Prompt Sanitizer: In-memory prompt injection neutralization before LLM transport.
• RAG Cosine Vector Similarity: SIMD-accelerated local vector embedding similarity computation.

📊 Explore live results & reproducible suites:

• 📈 Interactive Benches Dashboard — Real-time telemetry and microsecond visualizers on the official site.
• ⚖️ Comparative Benchmarks — Open benchmark repository with reproducible TechEmpower-style setups, Criterion HTML reports, memory profiling, and continuous performance regression CI.

• 🚀 Hybrid Hot-Reloading & Fast Linkers: Sub-second incremental compilation with mold and lld pre-configured in .cargo/config.toml, paired with WebSockets morphdom UI hot-swapping.
• 🎨 Developer Control Room & Nexus CMS: An all-in-one Web Suite (cargo rullst studio at :5555) with Data Browser, Visual Threat Radar, Real-time Metrics, and auto-generated Admin Panels (/nexus) from your Structs.
• 🛡️ RASP Engine & Pre-Controller Shield: Kernel-level AST payload filtering protecting against XSS, SQLi, and BOLA before requests ever reach your controllers.
• 🔑 Passkeys & WebAuthn (FIDO2): Hardware-backed passwordless authentication using biometric face/touch ID and security keys.
• 🌐 Provider-Agnostic AI (Local & Cloud): Connect to ANY local LLM (Ollama, LM Studio, vLLM, LocalAI, Jan.ai) or commercial cloud (Gemini, Claude, OpenAI, DeepSeek) with built-in prompt injection filters and PII masking.
• 💳 Capital SaaS Ledger & Billing: Real-time MRR/ARR analytics and constant-time HMAC signature verification for Stripe and LemonSqueezy webhooks.
• 🔐 Enterprise Vault & Memory Zeroization: Field-level database encryption (#[orm(encrypted)]) with cryptographic Zeroize memory clearing upon drop.
• 🔄 Expressive Active Record Transactions: Borrow-checker safe User::transaction(|tx| async move { ... }) with automatic task-local scoping (CURRENT_TX), commit-on-success, and rollback-on-error behavior.
• 🔄 Reverse ORM Scaffolding: Automatically reverse-engineer Rust struct models from existing database tables using cargo rullst make:models-from-db.
• 🔍 Static CLI Inspection: Inspect active route tables, ORM models, and JSON schemas directly in the terminal via cargo rullst inspect.
• 🛡️ Zero-Panic Policy: Hardened architecture built with typed AppError enums for 100% crash-free edge infrastructure.
• ⚡ Interactive Scaffolding: 1-click generators for Auth, ERPs, SaaS Starters, Uptime Monitors, and Cloud Deployments (cargo rullst deploy).

Rullst is built directly on top of Axum, Tokio, and Tower. It does not invent proprietary HTTP abstractions or locked-in router types. Every Rullst controller, extractor, and middleware maps 1:1 to standard Axum and Tower equivalents:

• Incremental Adoption: Mount existing axum::Router instances directly into rullst::server::Server.
• Standard SQLx: Run raw sqlx::Pool queries alongside rullst-orm without wrappers.
• Escape Hatch: Convert Rullst controllers back to raw Axum with a 1-line import change.
• 📖 Read the full Axum & SQLx Migration & Escape Hatch Guide.

SaaS Blueprint	LMS Blueprint

use rullst::{routing::get, html, Server, Response};

#[routes]
fn home() -> Response {
    html! {
        <div class="h-screen bg-slate-900 text-emerald-400 flex items-center justify-center">
            <h1>"Hello, Rullst!"</h1>
        </div>
    }
}

#[tokio::main]
async fn main() {
    Server::new()
        .route("/", get(home))
        .run()
        .await;
}

Rust has a breathtaking ecosystem, but finding the right tool can be overwhelming.
Here is an honest, objective breakdown of where Rullst stands compared to other beloved frameworks.

These are the titans of the Rust web ecosystem. They provide pristine routing, middlewares, and blazing-fast HTTP primitives. Actix-Web and Rocket pioneered the space, while Axum, Salvo, and Poem brought new paradigms.

• The Catch: They are fundamentally focused on HTTP. You have to wire the rest of the application yourself. You must choose, configure, and integrate your own Database ORM, Auth logic, Webhooks, CLI, and Background Workers.
• Where Rullst Excels: Batteries Included. Rullst actually uses Axum under the hood for its HTTP routing! But instead of leaving you in an empty room, Rullst gives you a fully furnished house. You get a CLI, ORM, Auth, Stripe integration, Background Workers, and automatic OpenAPI & TypeScript SDK generation out-of-the-box in 1 minute.

Loco is a fantastic full-stack framework heavily inspired by Rails. It also uses Axum and provides great generators. Topcoat is an experimental, batteries-included framework from the Tokio team that focuses on reactive server-side rendering (SSR) without writing JavaScript.

• Where Rullst Excels: Emotional Productivity & DX. Rullst takes a radically opinionated stance on Developer Experience. We provide an immersive Web-based Database Studio (cargo rullst studio), built-in Wasm Islands, zero-panic architectural guarantees, Nix reproducibility, and native Omni (Desktop/Mobile via Tauri) scaffolding. If you want the absolute easiest, most visually pleasing DX in Rust, Rullst is your home.

These are cutting-edge frameworks that let you write both frontend and backend in a single Rust file using Server Functions and SSR (similar to Next.js or Nuxt).

• The Catch: They are heavily Frontend/Component-Driven. Your server's primary job is to hydrate and serve UI components. If you need a traditional backend architecture (dedicated Workers, Stripe webhooks, robust ORM migrations, pure REST APIs for mobile apps), an isomorphic model can sometimes feel restrictive or overly coupled to the UI.
• Where Rullst Excels: Architectural Freedom & Synergy. Rullst is an API-First / Traditional Full-Stack (like Rails or Laravel). It gives you an uncompromised, heavy-duty backend layer. But we don't compete with Dioxus/Leptos/Tauri—we embrace them! Rullst allows you to use Dioxus for your frontend natively via Wasm Islands (cargo rullst build:client), or package your entire application into Desktop & Mobile apps via Tauri (cargo rullst make:omni).

Rullst is now a unified Monorepo! The framework's core (rullst), the database layer (rullst-orm), and the frontend connectivity (rullst-connect) are now engineered in lockstep under a single repository. This unified architecture ensures 100% compatibility across the stack, centralized security audits, and a seamless developer experience from backend to edge.

Explore the Ecosystem:

• 🦀 Rullst Core (Web Framework)
• 💾 Rullst-ORM (Database Layer)
• 🔌 Rullst-Connect (Frontend Integration)