Rullst v12.0.0 - AI-Native Full-Stack Rust Web Framework

How to build a SaaS with Rullst

Active Record & Parameterized SQLx ORM

Declare models with type-safe macros, transparent field encryption, and zero SQL injection vulnerability.

use rullst_orm::Orm;
use rullst::db::FromRow;

#[derive(Debug, Clone, FromRow, Orm)]
#[orm(table = "users")]
pub struct User {
    pub id: i32,
    pub email: String,
    #[orm(encrypted)] // Transparent Vault field encryption
    pub ssn: String,
}

// Simple Active Record queries
let user = User::find(1).await?;
let all_users = User::all().await?;

Native html! Macro & Zero-Bundle SSR

Blazing-fast JSX-like syntax in pure Rust that compiles directly into optimized static strings without runtime Virtual DOM overhead.

use rullst::html;

fn dashboard_view(user: &User) -> String {
    html! {
        
            "Welcome back, " { &user.email }
            "Your account is protected by RASP and Argon2id."
        
    }
}

RASP Protection & Granular RBAC

Pre-controller threat shield, Passkeys/WebAuthn, and ownership-based BOLA protection.

use rullst_security::{RbacGuard, HtmlSanitizer};
use rullst_core::AppError;

pub async fn update_document(user: User, doc_owner_id: i32) -> Result<(), AppError> {
    // Ensures current user owns resource or has 'admin' role
    RbacGuard::authorize_owner_or_role(&user, doc_owner_id, "admin")
        .map_err(|e| AppError::Forbidden(e))?;

    let safe_content = HtmlSanitizer::sanitize("User Content");
    Ok(())
}

Provider-Agnostic AI Client (`rullst-ai`)

Connect to ANY local runner (Ollama, LM Studio, vLLM, LocalAI) or commercial cloud (Gemini, Claude, OpenAI, DeepSeek) with prompt injection filters and PII masking.

use rullst_ai::ai::{AiClient, AiGuardrails, Message};

let client = AiClient::auto()?; // Detects Ollama / LM Studio / Gemini / OpenAI credentials
let clean_prompt = AiGuardrails::sanitize_prompt(&user_prompt);

let response = client.prompt(&clean_prompt).await?;

The Full-Stack Feature Matrix

Feature	Rullst	Loco	Topcoat	Dioxus / Leptos	Axum / Actix
HTTP & High-Performance Routing	✅ (Axum Engine)	✅	✅	✅ (SSR)	✅
Active Record & Data Mapper ORM	✅ (rullst-orm)	✅ (SeaORM)	✅ (Toasty)	❌	❌
Compile-Time Zero-Cost DI Container	✅ (rullst::di & Inject<T>)	❌	❌	❌	❌
1-Click PaaS Cloud Deployment	✅ (cargo rullst deploy)	❌	❌	❌	❌
RASP Security Layer (Pre-Controller)	✅ (rullst-security)	❌	❌	❌	❌
Passkeys & WebAuthn (FIDO2)	✅ (rullst-auth::passkey)	❌	❌	❌	❌
Granular RBAC & Permission Matrix	✅ (rullst-auth::rbac)	❌	❌	❌	❌
Zero-Trust Device Fingerprinting	✅ (rullst-security::zero_trust)	❌	❌	❌	❌
Rullst Vault & Field Encryption	✅ (#[orm(encrypted)] + Zeroize)	❌	❌	❌	❌
Synthetic Honeypots & Bot Ban	✅ (rullst-honey)	❌	❌	❌	❌
HMAC Cryptographic Audit Log	✅ (rullst-audit-log)	❌	❌	❌	❌
Visual Threat Radar (SOC Dashboard)	✅ (/studio/security)	❌	❌	❌	❌
Air-Gapped Local & Multi-Cloud AI	✅ (Ollama, LM Studio, vLLM, OpenAI, Claude, Gemini)	❌	❌	❌	❌
LiveView Reactive UI	✅ (rullst::live + make:live)	❌	✅ (Signals)	❌	❌
gRPC Microservices & Protobuf	✅ (rullst-grpc / Tonic)	❌	❌	❌	❌
Kubernetes Native Manifests & Probes	✅ (make:k8s + /health)	❌	❌	❌	❌
Interactive Scalar API Docs	✅ (Built-in /docs)	❌	❌	❌	❌
Web-based Database Studio	✅ (Rullst Studio :5555)	❌	❌	❌	❌
Auto-Generated Admin Panel (CMS)	✅ (Rullst Nexus /nexus)	❌	❌	❌	❌
Kernel Telemetry & Prometheus Exporter	✅ (rullst::radar + /metrics)	❌	❌	❌	❌
Embedded IoT & Edge Hardware (#![no_std])	✅ (rullst-iot / STM32 / ESP32)	❌	❌	❌	❌
SaaS Revenue Dashboard & Stripe Billing	✅ (rullst-capital)	❌	❌	❌	❌
Background Workers & Redis Queues	✅ (rullst::queue)	✅ (Task worker)	❌	❌	❌
Wasm Islands & Hybrid SSR	✅ (#[client_component])	❌	❌	✅ (Core focus)	❌
TypeScript AST SDK Generator	✅ (cargo rullst generate:ts)	❌	❌	❌	❌
Zero-Panics Policy Enforced	✅ (Typed AppError & Lints)	❌	❌	❌	❌
Framework Escape Hatch (Zero Lock-in)	✅ (cargo rullst eject)	❌	❌	❌	❌

The Interactive CLI Experience

Stop memorizing flags. The Rullst CLI guides you through project setup, database migrations, authentication, AI configuration, and cloud deployment interactively.

bash — cargo rullst

  ██████╗ ██╗   ██╗██╗     ██╗     ███████╗████████╗
  ██╔══██╗██║   ██║██║     ██║     ██╔════╝╚══██╔══╝
  ██████╔╝██║   ██║██║     ██║     ███████╗   ██║   
  ██╔══██╗██║   ██║██║     ██║     ╚════██║   ██║   
  ██║  ██║╚██████╔╝███████╗███████╗███████║   ██║   
  ╚═╝  ╚═╝ ╚═════╝ ╚══════╝╚══════╝╚══════╝   ╚═╝

The Ultimate Full-Stack Rust Framework v12.0.0
⚡ Security · Speed · Developer Experience ⚡

? Navigate with ↑↓, confirm with Enter
> ✨ Create New Project (API, Fullstack or SaaS Blueprint)
  📁 Already have a project? (Dev, Scaffold, DB, Auth, Deploy...)
  💡 View Help & Commands (Framework Reference)
  ❌ Exit

Official Benchmarks & Performance

Rullst delivers high throughput and low latencies comparable to raw Axum, but provides a fully furnished fullstack experience out-of-the-box.

Requests per Second (JSON)

Higher is better (Containerized, 125 Conns)

Rullst (Rust)

10,847 req/s

Spring Boot (Java)

3,480 req/s

NestJS (JS)

1,565 req/s

Django (Python)

692 req/s

Laravel Octane

536 req/s

SSR Engine Speed

Lower is better (CPU time per render)

Rullst (html!)

1.07 µs

Tera Template

2.07 µs

Dioxus (VDOM)

4.72 µs

Leptos (View)

9.54 µs

The Honest Conclusion on Throughput

Rullst is built directly on top of Axum and Tokio. As the data clearly shows, adding a complete full-stack framework layer (Active Record ORM, CSRF protection, RASP runtime inspection, and structured error boundaries) still comfortably handles over 10,000 requests per second with sub-millisecond latency.

Compared to dynamic ecosystems (Node.js, Python, PHP, Ruby), Rullst delivers 10x to 50x higher throughput and orders of magnitude lower memory consumption.

If your goal is to build a full-fledged, secure, and maintainable SaaS product with databases, queues, AI integrations, Hot-Reloading, and an Auto-CMS in a matter of days—while still enjoying bare-metal speed—Rullst is your framework.

Performance vs. DX Scorecard

Framework	Language	Performance	DX	Notes
Rullst	Rust	⭐⭐⭐⭐⭐	⭐⭐⭐⭐⭐	High-level fullstack APIs, ORM, Studio, Passkeys, RASP, and Hot-Reloading with Rust memory safety.
Axum / Actix	Rust	⭐⭐⭐⭐⭐	⭐⭐	Absolute maximum raw speed, but you must manually configure ORMs, Auth, and background jobs.
Loco	Rust	⭐⭐⭐⭐	⭐⭐⭐⭐	Rails-like experience in Rust, good generators, but steeper learning curve.
Leptos / Dioxus	Rust	⭐⭐⭐⭐	⭐⭐⭐⭐	Great for fullstack WASM frontend, but backend API patterns are tightly coupled to SSR.
Fiber / Gin	Go	⭐⭐⭐⭐	⭐⭐⭐	Fast and simple, but lacks built-in fullstack features (Studio, Admin Panel, Vault).
Spring Boot	Java	⭐⭐⭐	⭐⭐⭐	Enterprise standard, decent speed, but heavy memory footprint and extensive boilerplate.
NestJS	JS/TS	⭐⭐	⭐⭐⭐⭐	Good architecture, but single-threaded event loop bottlenecks under high load.
Ruby on Rails	Ruby	⭐⭐	⭐⭐⭐⭐⭐	Pioneered batteries-included DX, but throughput is limited under heavy concurrent traffic.
Laravel	PHP	⭐	⭐⭐⭐⭐⭐	Incredible ecosystem and DX, but higher server costs to handle equivalent load.
Django	Python	⭐	⭐⭐⭐⭐⭐	Great batteries included framework, but CPU-bound operations suffer from GIL bottlenecks.
Next.js	JS/TS	⭐	⭐⭐⭐⭐	Popular for frontend SSR, but backend serverless functions introduce cold starts and latency.

Why Rullst? Key Architectural Benefits

🛡️ Enterprise-Grade Security Shield

Rullst is "Secure by Design", shipping natively with pre-controller RASP AST inspection, Passkeys/WebAuthn FIDO2 authentication, Double-Submit CSRF, and synthetic bot honeypots.

🔐 Enterprise Vault & Zeroization

Field-level transparent encryption (#[orm(encrypted)]) paired with cryptographic memory wiping (Zeroize) ensuring zero memory leak vulnerabilities.

⚡ Auto-Migrations in Dev Server

Experience unmatched Developer Experience. cargo rullst dev automatically and silently runs pending migrations before hot-reloading your application.

🤖 Provider-Agnostic AI Integration

Connect seamlessly to ANY local LLM (Ollama, LM Studio, vLLM, LocalAI) or commercial cloud (Gemini, Claude, OpenAI) with prompt injection filters and PII masking.

🛡️ Zero-Panic Production Policy

All runtime paths use strongly typed AppError enums. Zero runtime panics or hidden unwraps in production code.

🔒 Strict Type Safety (No Dynamic Traits)

Rullst avoids heavy usage of dyn Trait in favor of static dispatch. This guarantees maximum compiler optimizations, monomorphization, and smaller binaries.

🗺️ Explicit API Design

No hidden magic or unexpected middleware sequencing. Routes, state, and filters are explicitly declared for maximum maintainability.

🌍 Edge Fusion & Replication

Compile to WebAssembly for Cloudflare Workers globally, backed by built-in Turso/libsql replication for sub-millisecond database read latencies worldwide.

📱 Omni-Frontend Wasm & Tauri

Write interactive client components strictly in Rust (#[client_component]) and package desktop/mobile apps natively with Tauri.

Rust for those who want to build, not suffer.

💡 The Rullst Philosophy

Our Core Tenets

How to build a SaaS with Rullst

Active Record & Parameterized SQLx ORM

Native html! Macro & Zero-Bundle SSR

"Welcome back, " { &user.email }

RASP Protection & Granular RBAC

Provider-Agnostic AI Client (`rullst-ai`)

The Full-Stack Feature Matrix

The Interactive CLI Experience

Official Benchmarks & Performance

Requests per Second (JSON)

SSR Engine Speed

The Honest Conclusion on Throughput

Performance vs. DX Scorecard

Why Rullst? Key Architectural Benefits

🛡️ Enterprise-Grade Security Shield

🔐 Enterprise Vault & Zeroization

⚡ Auto-Migrations in Dev Server

🤖 Provider-Agnostic AI Integration

🛡️ Zero-Panic Production Policy

🔒 Strict Type Safety (No Dynamic Traits)

🗺️ Explicit API Design

🌍 Edge Fusion & Replication

📱 Omni-Frontend Wasm & Tauri

📈 Performance CI Dashboards

💡 The Rullst Philosophy

Our Core Tenets

How to build a SaaS with Rullst

Active Record & Parameterized SQLx ORM

Native html! Macro & Zero-Bundle SSR

"Welcome back, " { &user.email }

RASP Protection & Granular RBAC

Provider-Agnostic AI Client (`rullst-ai`)

The Full-Stack Feature Matrix

The Interactive CLI Experience

Official Benchmarks & Performance

Requests per Second (JSON)

SSR Engine Speed

The Honest Conclusion on Throughput

Performance vs. DX Scorecard

Why Rullst? Key Architectural Benefits

🛡️ Enterprise-Grade Security Shield

🔐 Enterprise Vault & Zeroization

⚡ Auto-Migrations in Dev Server

🤖 Provider-Agnostic AI Integration

🛡️ Zero-Panic Production Policy

🔒 Strict Type Safety (No Dynamic Traits)

🗺️ Explicit API Design

🌍 Edge Fusion & Replication

📱 Omni-Frontend Wasm & Tauri

📈 Performance CI Dashboards

Privacy & Cookie Preferences

🔒 Privacy Policy & Data Protections