Rullst is built with a "Zero-Panic Policy" and tested against the most rigorous standards in the industry.
Our continuous pipeline guarantees absolute safety for production edge infrastructure:

Security Audit	Status	Description
OSSF Scorecard		Supply-chain security & best practices
Codecov		Strict code coverage enforcement
OpenSSF		Open source security standards
Matrix DB Tests		Dockerized PostgreSQL & MySQL integration tests
Continuous Fuzzing		Fuzzing against edge cases & panics
Property Testing		Validating complex logic against edge cases
CodeQL SAST		Advanced semantic code analysis
OWASP ZAP DAST		Dynamic vulnerability scanning
Cargo Deny		Banning unmaintained/vulnerable crates
Cargo Audit		Continuous scanning for crate vulnerabilities
Cargo SemVer		Strict SemVer API breakage checks
Cargo Machete		Detecting unused and bloated dependencies
Benchmark CI		Continuous performance regression testing
Snapshot Testing		UI & Macro structural regression testing
E2E Smoke Verification		Live HTTP server boot and real client request assertions
Concurrency Sanitizers		Data-race (TSan) and memory corruption (ASan) detection
Spellcheck CI		Automated typo detection across docs and code
Clippy Lints		Strict compiler & style linting
Unsafe Policy		100% memory safe. No unsafe code blocks
Miri UB Detection		Detecting Undefined Behavior and memory leaks
Kani Verifier		Automated reasoning and formal verification
Mutation Testing		Mutation testing for test suite robustness
Architecture Linter		Enforcing architectural boundaries
SLSA Level 3		Supply-chain Levels for Software Artifacts
Panic Policy		Graceful error handling across the framework
Secret Scanning		Automated CI prevention of leaked credentials
no_std Build Check		Validates rullst-iot compiles on STM32, ESP32-C3, Cortex-M bare-metal targets
OTA Signature Verification		Ed25519 cryptographic integrity check on all OTA firmware updates
PQC Compliance Audit		Weekly NIST ML-KEM / Kyber & HSM compliance audit (unsafe-free cryptographic modules)
MSRV		Minimum Supported Rust Version

📖 Read the detailed breakdown of all our CI/CD Security Workflows here

Unlike other frameworks, Rullst strives to be simultaneously simple and complete, with a relentless focus on security and developer experience (DX).

The origins of this philosophy can be traced back to the very creation of the Rust programming language. The story goes that Graydon Hoare, the original creator of Rust, lived in an apartment building with an elevator that kept crashing due to software bugs in its underlying C/C++ code. Frustrated by having to climb the stairs because of memory safety vulnerabilities, he set out to create a language that was incredibly fast, yet guaranteed memory safety by design—so that developers could build things that "just worked" without fear.

Rullst was forged with this exact mindset. We believe that web development shouldn't be a constant struggle against the framework, the language, or runtime bugs. Rullst is built for those who want to build with ease and safety, harnessing the raw speed and resource efficiency of Rust.

1. Simple yet Complete: We solve the hardest web development problems out-of-the-box securely (routing, auth, ORM, background jobs, hot-reloading), without sacrificing simplicity or completeness. You shouldn't have to piece together 15 different micro-libraries just to build a secure SaaS.

2. Built for Humans and AIs: Rullst is architected to be highly legible and free of runtime "magic". By heavily utilizing static dispatch and compile-time guarantees, the codebase is transparent. This empowers both human developers and AI coding agents to collaborate and build production-ready systems rapidly, even without deep prior framework knowledge.

Rullst is not just a tool; it is a commitment to Emotional Productivity. We take care of the boilerplate and the security pitfalls so you can focus entirely on creating value.

Never programmed in Rust before? No problem! Follow these simple steps to go from zero to a running web application:

Rullst runs on Rust. If you don't have Rust installed yet, install it using the official toolchain installer:

• Linux & macOS:

  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

• Windows: Download and run the installer from rustup.rs or run in PowerShell:

  winget install --id Rustlang.Rustup

Tip: Restart your terminal and verify the installation by running cargo --version.

In your terminal, choose how you want to create your project:

# Option A: Create a new folder named 'my_app' and enter it
cargo new my_app
cd my_app

# Option B: If you already created and opened an empty folder in your terminal/VS Code:
cargo init

⚠️ Important: Always make sure your terminal is inside the project folder containing the generated Cargo.toml file!

my_app/
├── Cargo.toml    # (Dependencies and project metadata)
└── src/
    └── main.rs   # (Your server application entry point)

Run these commands in your terminal (inside your project folder) to add Rullst and the Tokio runtime:

cargo add rullst
cargo add tokio --features full

Open src/main.rs in your code editor and replace its entire contents with the Hello World code below:

Build modern, type-safe full-stack web applications with zero client JS bundles, built-in OWASP security, and sub-millisecond cold starts:

use rullst::{html, response::Html, routes, Server};

// 1. Type-Safe Server-Side Rendered View with JSX-like compile-time syntax
async fn home() -> Html<String> {
    Html(html! {
        <div class="h-screen bg-slate-900 text-emerald-400 flex items-center justify-center">
            <h1 class="text-4xl font-bold">"Hello, Rullst!"</h1>
        </div>
    })
}

#[tokio::main]
async fn main() {
    // 2. Declarative, zero-reflection route dispatching
    let app = routes![
        get("/" => home)
    ];

    // 3. Launch high-throughput Tokio async HTTP server on port 3000
    Server::new(app)
        .run(3000)
        .await
        .unwrap();
}

• ⚡ Zero-Bundle SSR (html!): Compile-time JSX-like syntax that generates blazing fast static strings with automatic XSS sanitization and zero virtual-DOM overhead.
• 🛣️ Expressive Routing (routes!): Clean declarative macro mapping directly to Tokio/Axum static dispatch without runtime reflection.
• 🛡️ Production-Ready Kernel (Server): Inherits automatic OWASP Secure Headers A+, double-submit CSRF protection, and microsecond telemetry out of the box.

Inside your project folder (where Cargo.toml is located), start the server:

cargo run

Open http://localhost:3000 in your browser to see your high-performance web application running live! 🎉

💡 Pro-Tip (CLI Scaffolding): Want a complete MVC boilerplate with database migrations, JWT auth, and Docker setup? Use the official CLI generator:

cargo install cargo-rullst
cargo rullst

SaaS Blueprint	LMS Blueprint

We've rewritten our entire documentation from scratch into a beautiful, high-performance website. Discover everything Rullst can do, read the benchmarks, and master the framework:

👉 Explore the Official Website & Docs

💬 Join the Community on Discord

Found a bug? Report an Issue

Rullst's "Zero-Cost Abstraction" architecture provides full-stack productivity without sacrificing bare-metal speed:

• SSR HTML5 Rendering: Zero-bundle static string rendering avoiding Virtual DOM allocations.
• Macro Routing (routes!): Direct compile-time static dispatch powered by Axum and Tokio.
• HtmlSanitizer & XSS Shield: High-speed Ammonia AST payload filtering.
• RbacGuard Role & Ownership BOLA: Zero-allocation bitflags security authorization.
• Vault In-Memory Zeroization: Cryptographic drop memory wiping preventing cold-boot RAM inspection.
• Stripe Webhook Signature Verification: Constant-time HMAC-SHA256 protecting against timing attacks.
• Passkey WebAuthn Challenge Parser: High-performance FIDO2 passwordless auth parsing.
• Zero-Trust Device Fingerprinting: Subnet-aware session binding with zero runtime overhead.
• AI Guardrail Prompt Sanitizer: In-memory prompt injection neutralization before LLM transport.
• RAG Cosine Vector Similarity: SIMD-accelerated local vector embedding similarity computation.

📊 Explore live results & reproducible suites:

• 📈 Interactive Benches Dashboard — Real-time telemetry and microsecond visualizers on the official site.
• ⚖️ Comparative Benchmarks — Open benchmark repository with reproducible TechEmpower-style setups, Criterion HTML reports, memory profiling, and continuous performance regression CI.

• 🚀 Hybrid Hot-Reloading & Fast Linkers: Sub-second incremental compilation with mold and lld pre-configured in .cargo/config.toml, paired with WebSockets morphdom UI hot-swapping.
• 🎨 Developer Control Room & Nexus CMS: An all-in-one Web Suite (cargo rullst studio at :5555) with Data Browser, Visual Threat Radar, Real-time Metrics, and auto-generated Admin Panels (/nexus) from your Structs.
• 🛡️ RASP Engine & Pre-Controller Shield: Kernel-level AST payload filtering protecting against XSS, SQLi, and BOLA before requests ever reach your controllers.
• 🔑 Passkeys & WebAuthn (FIDO2): Hardware-backed passwordless authentication using biometric face/touch ID and security keys.
• 🌐 Provider-Agnostic AI (Local & Cloud): Connect to ANY local LLM (Ollama, LM Studio, vLLM, LocalAI, Jan.ai) or commercial cloud (Gemini, Claude, OpenAI, DeepSeek) with built-in prompt injection filters and PII masking.
• 💳 Capital SaaS Ledger & Billing: Real-time MRR/ARR analytics and constant-time HMAC signature verification for Stripe and LemonSqueezy webhooks.
• 🔐 Enterprise Vault & Memory Zeroization: Field-level database encryption (#[orm(encrypted)]) with cryptographic Zeroize memory clearing upon drop.
• 🔄 Expressive Active Record Transactions: Borrow-checker safe User::transaction(|tx| async move { ... }) with automatic task-local scoping (CURRENT_TX), commit-on-success, and rollback-on-error behavior.
• 🔄 Reverse ORM Scaffolding: Automatically reverse-engineer Rust struct models from existing database tables using cargo rullst make:models-from-db.
• 🔍 Static CLI Inspection: Inspect active route tables, ORM models, and JSON schemas directly in the terminal via cargo rullst inspect.
• 🛡️ Zero-Panic Policy: Hardened architecture built with typed AppError enums for 100% crash-free edge infrastructure.
• ⚡ Interactive Scaffolding: 1-click generators for Auth, ERPs, SaaS Starters, Uptime Monitors, and Cloud Deployments (cargo rullst deploy).

While single-paradigm frameworks force developers into a single rigid model (either heavy WASM hydration, Virtual DOM allocations, or legacy templates), Rullst provides all 5 frontend presentation paradigms natively and interchangeably with zero lock-in:

Rullst is built directly on top of Axum, Tokio, and Tower. It does not invent proprietary HTTP abstractions or locked-in router types. Every Rullst controller, extractor, and middleware maps 1:1 to standard Axum and Tower equivalents:

• Incremental Adoption: Mount existing axum::Router instances directly into rullst::server::Server.
• Standard SQLx: Run raw sqlx::Pool queries alongside rullst-orm without wrappers.
• Escape Hatch: Convert Rullst controllers back to raw Axum with a 1-line import change.
• 📖 Read the full Axum & SQLx Migration & Escape Hatch Guide.

Rust has a breathtaking ecosystem, but finding the right tool can be overwhelming.
Here is an honest, objective breakdown of where Rullst stands compared to other beloved frameworks.

These are the titans of the Rust web ecosystem. They provide pristine routing, middlewares, and blazing-fast HTTP primitives. Actix-Web and Rocket pioneered the space, while Axum, Salvo, and Poem brought new paradigms.

• The Catch: They are fundamentally focused on HTTP. You have to wire the rest of the application yourself. You must choose, configure, and integrate your own Database ORM, Auth logic, Webhooks, CLI, and Background Workers.
• Where Rullst Excels: Batteries Included. Rullst actually uses Axum under the hood for its HTTP routing! But instead of leaving you in an empty room, Rullst gives you a fully furnished house. You get a CLI, ORM, Auth, Stripe integration, Background Workers, and automatic OpenAPI & TypeScript SDK generation out-of-the-box in 1 minute.

Loco is a fantastic full-stack framework heavily inspired by Rails. It also uses Axum and provides great generators with SeaORM and Tera templates. Topcoat is a new, experimental batteries-included framework from the Tokio team focusing on server-rendered reactivity via macro-transpiled micro-JS and Toasty ORM.

• Where Rullst Excels: Sovereign Multi-Engine & Total DX. Rullst unifies all 5 frontend paradigms (HTMX, LiveView, Wasm Islands, Pico Semantic CSS, Tera templates), provides an immersive Web-based Database Studio (cargo rullst studio at :5555), built-in RASP security shields, zero-panic architectural guarantees, and native Omni desktop/mobile packaging via Tauri 2.0 (cargo rullst make:omni).

These are cutting-edge frameworks that let you write both frontend and backend in a single Rust file using Server Functions and SSR (similar to Next.js or Nuxt).

• The Catch: They are heavily Frontend/Component-Driven. Your server's primary job is to hydrate and serve UI components. If you need a traditional backend architecture (dedicated Workers, Stripe webhooks, robust ORM migrations, pure REST APIs for mobile apps), an isomorphic model can sometimes feel restrictive or overly coupled to the UI.
• Where Rullst Excels: Architectural Freedom & Synergy. Rullst gives you an uncompromised, heavy-duty backend layer. You can use Rullst's native Reactive Wasm Islands (rullst::island / #[client_component]) or LiveView Server-Driven UI (rullst::live), and package the application into Desktop & Mobile apps via Tauri 2.0 (cargo rullst make:omni).

Rullst is now a unified Monorepo! The framework's core (rullst), the database layer (rullst-orm), and the frontend connectivity (rullst-connect) are now engineered in lockstep under a single repository. This unified architecture ensures 100% compatibility across the stack, centralized security audits, and a seamless developer experience from backend to edge.

Explore the Monorepo Ecosystem:

• 🦀 rullst-core: Core HTTP server, routing engine, and OpenTelemetry kernel.
• 💾 rullst-orm: Active Record ORM, automated migrations, and multi-tenancy.
• 🛡️ rullst-auth: Passkeys/WebAuthn, Argon2id, JWT, and RBAC authorization.
• 🔒 rullst-security: RASP deep inspection, Honeypot bot traps, XSS/CSP sanitization, and HMAC audit log.
• 🤖 rullst-ai: Provider-agnostic AI agent engine (Gemini, OpenAI, Claude, DeepSeek, Ollama).
• 💰 rullst-capital: SaaS MRR/ARR analytics, Stripe/Alipay/InfinitePay webhooks, and NFS-e digital invoicing.
• 🔌 rullst-connect: Message queues, WebSockets sync, and OAuth2/OIDC social login.
• 📡 rullst-iot: High-throughput MQTT 5.0 client, sensor telemetry ingestion, and edge computing.
• ✉️ rullst-mail: Transactional email delivery engine with anti-phishing and DLP secret scanning.
• 📊 rullst-studio: Developer Control Room (:5555) with live telemetry and data browser.
• ⚙️ rullst-nexus: Auto-generated Admin CMS (/nexus) and SOC Threat Radar.
• 🛠️ cargo-rullst: CLI scaffolding, AST IDOR scanner, and 1-Click deployer.

Rullst is an opinionated, developer-first full-stack web framework for Rust, obsessively designed for Emotional Productivity and Security. It solves the biggest problem in the Rust web ecosystem: the high barrier of entry. With Rullst, you spend your energy building your business, not fighting borrow checkers and manual routing setups.