Everything included
A complete, production-tested foundation. Configure your keys and start building features on day one.
Authentication
- Supabase SSR (cookie-based PKCE)
- Sign-in / sign-up / OAuth callback
- Server + browser + admin clients
- Route protection in middleware
Database
- Postgres via Supabase
- Drizzle ORM (type-safe schema + migrations)
- Row Level Security on every table
- Auto profile creation on signup
Billing
- Razorpay + Stripe adapters
- Server-authoritative subscription store
- Webhook idempotency (dedup ledger)
- Signature verification (HMAC + Stripe)
Observability
- PostHog (web + server)
- Sentry (replays + traces)
- /api/health endpoint
- Structured request logging
Security
- Strict CSP with per-request nonce
- Full security header bundle (HSTS, etc.)
- Rate limiting on API routes
- Private storage bucket
SEO
- Metadata + openGraph defaults
- Dynamic OG image (edge runtime)
- JSON-LD structured data
- sitemap.xml + robots.txt + manifest
Quality
- TypeScript (strict, noUncheckedIndexedAccess)
- ESLint 9 flat config + Prettier
- Vitest unit tests
- Playwright E2E + GitHub Actions CI