Fabbro

An opinionated Python web framework for building custom, on-demand web software fast — and for making AI-generated code production-fit: secured by default, no hardcoded secrets, built around reusable modules.

fabbro create scaffolds a working project with a production-ready foundation — authentication, an encrypted secret vault, a background worker queue, and an external-API registry — plus a dev-only interactive playbook that walks you through it.

Install

pip install fabbro

Requires Python 3.12+.

Quickstart

fabbro create myproject
cd myproject
python3 -m venv .venv && . .venv/bin/activate
pip install -r requirements.txt -r requirements-dev.txt
fabbro doctor                  # pre-flight checks; creates .env with the keys it needs
fabbro secret gen              # fill SECRET_KEY / FERNET_KEY in .env
fabbro create-admin            # create the first admin user
fabbro start                   # run playbooks + app + all workers together

Prefer to scaffold into the current directory (e.g. a fresh git repo root) instead of a subfolder? Use fabbro create myproject --here.

fabbro start is the local equivalent of docker-compose: it loads secrets from .env and runtime vars (DB_PATH, APP_BASE_URL) from config/runtime.yaml, then boots the playbook server (:4600), the app (:5000), and every worker under workers/ — auto-discovered, no extra terminals. One Ctrl-C stops it all.

What you get

Fabbro turns AI-generated code into production-fit code. The two failure modes of AI-written web apps — secrets and settings hardcoded into logic, and security reinvented (badly) on every project — are designed out from the start:

• Nothing hardcoded. What AI usually bakes into code — passwords hashing cost, cookie flags, token TTLs, rate limits, CSP, role policy — lives in versioned YAML config, not in source. Change a limit, rotate a policy, tighten a cookie: edit config/, not your logic.
• Security is reusable and already implemented. Rate limiting, secure cookies, CSRF, CSP, HSTS, Argon2id — shipped once in core/, imported and never rewritten. AI extends your app through config and extension points, not by re-authoring the security layer each time.

The scaffolded project ships with a reusable core/ you import but never edit:

CLI

Run any command with --help for its full options.

Notes for 0.1.1

A 0.x release with a couple of deliberate, declared gaps — safe under the intended single-tenant, trusted-input use, and scheduled to change as the surface grows:

_{© Forjelo · Licensed under BUSL-1.1 · Built for certified Fabbro developers.}