You are an expert SaaS architect and developer. Your task is to create a Minimum Viable Product (MVP) for a tool called 'SaaS Core Security' that helps early-stage SaaS founders fix common technical debt issues that arise from rapid prototyping ('vibe coding'). The MVP should be a multi-page web application built with Next.js (App Router), TypeScript, and Tailwind CSS. It needs to connect to a PostgreSQL database managed by Drizzle ORM.
The application will have the following core functionalities:
1. **User Authentication:** Implement secure user authentication using NextAuth.js with credentials provider and JWT sessions. Users should be able to sign up, log in, and log out. Protect routes that require authentication.
2. **Project Management:** Users can create and manage 'projects'. Each project represents a SaaS product they want to analyze. Projects should have basic metadata like name and URL.
3. **Code Analysis (Conceptual MVP):** The MVP will *simulate* code analysis for demonstration purposes. When a user adds a project URL, the system will present pre-defined 'vulnerabilities' based on the common issues described in the problem statement. We will not be performing actual static code analysis in this MVP, but the UI should reflect that it *could*.
* **Auth Analysis:** Simulate findings for 'Auth is held together with tape'. Show mock findings like 'No role-based access detected', 'Session tokens in local storage', 'Missing audit logs'.
* **Database Analysis:** Simulate findings for 'One god table with 35 columns'. Show mock findings like 'Potential full table scans detected', 'Lack of database indexing on critical tables'.
* **Error Handling Analysis:** Simulate findings for 'No error handling anywhere'. Show mock findings like 'API calls may fail silently', 'Webhook processing lacks robust error catching'.
* **Integration Analysis:** Simulate findings for 'Stripe integration works until it doesn't'. Show mock findings like 'Stripe webhook endpoint may return 500 errors'.
4. **Drizzle Schema & Migrations:** Define a Drizzle schema for `users`, `projects`, and mock `vulnerabilities` (linked to projects). Implement Drizzle migrations for database setup.
5. **API Routes (App Router Handlers):** Create API routes within the `app/api/` directory for:
* CRUD operations for Projects (`/api/projects` - POST, GET, PUT, DELETE).
* Simulated analysis initiation (`/api/projects/[projectId]/analyze` - POST).
* Fetching simulated vulnerability data for a project (`/api/projects/[projectId]/vulnerabilities` - GET).
6. **UI (React Server Components & Client Components):** Build a clean, multi-page UI using React Server Components and Client Components where appropriate.
* **Pages:** `/`, `/auth/signin`, `/auth/signup`, `/dashboard`, `/dashboard/projects/new`, `/dashboard/projects/[projectId]`, `/dashboard/projects/[projectId]/analysis`.
* The `/dashboard/projects/[projectId]/analysis` page should display the simulated findings in a clear, organized manner, categorized by Auth, Database, Error Handling, and Integrations.
**Technical Stack:**
* **Framework:** Next.js 14 (App Router)
* **Language:** TypeScript
* **Styling:** Tailwind CSS
* **Database:** PostgreSQL
* **ORM:** Drizzle ORM
* **Authentication:** NextAuth.js
* **Deployment Target:** Vercel (assume standard deployment setup)
**Instructions:**
* Structure the project using the Next.js App Router conventions (`app/` directory).
* Implement proper error handling in API routes and client-side components.
* Ensure the Drizzle schema is well-defined and migrations are set up.
* For the 'Code Analysis' part, focus on building the UI and data structure to *represent* the analysis findings. The actual parsing of external codebases is out of scope for this MVP. Use mock data that simulates the types of findings described.
* The goal is to provide a functional MVP that showcases the *potential* of the tool and its user experience, allowing founders to see how their 'vibe-coded' app *would* be analyzed.