// the find
imbhargav5/nextbase-nextjs-supabase-starter
🚀⚡️ Free Boilerplate and Starter kit for Next.js 16+, Supabase, Tailwind CSS 4 and TypeScript. 🚀 Next.js 🔥 Supabase 💻 TypeScript 💚 ESLint 🎨 Prettier 🐶 Husky 🧹 Lint-Staged 🧪 Jest 🧪 Testing Library 🕹️ Playwright ✍️ VSCode 🌪️ Vercel 🎨 PostCSS 🍃 Tailwind CSS ⚛️ React Query
A Next.js 16 + Supabase starter kit aimed at solo founders and small teams who want auth, RLS, server actions, and a monorepo scaffold without building it from scratch. It's opinionated in a good way — Supabase is the only auth/DB choice, and the patterns for SSR cookies and Cache Components are already worked out. The free version is a genuine foundation; the premium upsell is aggressive but honest about what's missing.
The SSR auth wiring is one of the harder things to get right with Supabase and Next.js App Router — `@supabase/ssr` clients split correctly between browser, server components, actions, and middleware, which is exactly where most people's first attempt breaks. RLS is enforced at the database layer with actual policies per table, not just a middleware check that a forgotten route can bypass. The data-access layer is cleanly partitioned by trust boundary (`anon/`, `auth/`, `user/`, `rsc-data/`) rather than dumping everything in a single `lib/`. Switching to `oxlint` + `oxfmt` over ESLint + Prettier is a real quality-of-life call — feedback is noticeably faster on any non-trivial codebase.
The free tier is deliberately hobbled as a funnel to paid kits — no Stripe, no teams, no email, no multi-tenancy — so you hit the paywall almost immediately when building anything real. The optional `effect-ts` integration is an odd inclusion: it's a significant mental model to import for a starter kit, and teams that don't already know Effect will likely ignore it or get confused about when to use it versus the plain Supabase helpers. The static sitemap files committed to `public/` (`sitemap-0.xml`, `sitemap.xml`) alongside a `next-sitemap` postbuild config are contradictory — one of them will silently win and it probably won't be the dynamic one. Screenshot placeholders throughout the README make it hard to evaluate what the actual UI looks like before cloning.