solutions · build & engineering capability

Next.js + Supabase builds that hold up in production, auth, RLS, and all.

The stack is not the hard part; the schema, the RLS policies, and the billing edge cases are. I design those first, then ship the app through Claude Code agent workflows with senior review on every diff. Proven at 28,000 pages on HostList.

book a 30-min call the hostlist case study

HostList: ~28,000 pages live since 2024 · RLS on every table · Stripe billing wired end to end · senior-reviewed delivery

who this is for

SaaS founders building the first version

You want an MVP that does not need a rewrite at 1,000 users. The schema, auth, and billing decisions made in week one decide whether that happens.

Teams outgrowing no-code

Bubble or Webflow got you to revenue, and now you need real auth, a real database, and features the platform cannot express. Time for the production stack.

Directory and marketplace operators

Programmatic SEO at scale needs Postgres, ISR, and a sitemap pipeline that survives 50,000 URLs. I run HostList on exactly this stack.

Product teams with a half-built Supabase app

The prototype works but the schema is improvised and RLS is off. You need a senior on the data model before the next feature, not after the first breach.

the stack

/01 Next.js App Router Server components, ISR, and edge rendering matched per route, so the app is fast where it is public and dynamic where it is logged in.
/02 Supabase Postgres, Auth, row-level security, Storage, and Edge Functions. The schema and RLS policies are designed and reviewed by a senior, not generated.
/03 Stripe Subscriptions, metered billing, and invoicing flows, including the Net-30 quote-and-approve patterns B2B products actually need.
/04 Vercel Preview deployments on every pull request, edge caching, and a deploy pipeline your team can operate without me.
/05 Typesense / Algolia Faceted search at catalogue scale, indexed from Postgres, when your product outgrows ILIKE queries.
/06 Claude Code delivery The build ships through agentic engineering: agent workflows carry the volume, a senior engineer reviews every diff.

what you get

Postgres schema and RLS policy set designed before the first screen, documented in the repo
Auth flows done properly: server-side session validation, OAuth providers, role-based access
Billing wired end to end: Stripe products, webhooks, dunning, and the upgrade/downgrade paths
ISR and caching strategy per route, with a Core Web Vitals budget enforced at build time
Test coverage on the paths that lose you money when they break: auth, billing, data writes
Search, filtering, and pagination patterns that hold up past 10,000 records
A deploy pipeline on Vercel with preview environments your whole team can use
Code ownership transferred at launch, with architecture notes for the next engineer

how it runs

/01 Scope and schema The data model and RLS design come first, before any UI. Most Supabase project failures trace back to an improvised schema; this step is where they are prevented.
/02 Build Weekly preview deploys on Vercel from day one. You click through the real app every week, not a staging mirage at the end.
/03 Hardening RLS audit on every table, load checks on the hot paths, billing edge cases, and Core Web Vitals verification on the public surface.
/04 Launch and growth SEO transport if you are replacing an existing site, monitoring wired in, and an optional retainer for the feature roadmap after launch.

proof

hire next.js →

common questions

Why Next.js and Supabase together?

They cover the full application surface with the least glue code: Next.js handles rendering, routing, and the public-facing performance story, while Supabase provides Postgres, auth, storage, and row-level security on infrastructure you can inspect. One senior engineer can own the whole stack, which keeps both velocity and accountability high. I run HostList, about 28,000 pages, on exactly this pairing.

Is Supabase production-ready for a SaaS?

Yes. Under Supabase is plain Postgres, the most battle-tested open-source database there is, plus auth and storage layers used by hundreds of thousands of projects. The production risks are almost always in how it is used: missing RLS policies, service-role keys in client code, unindexed hot queries. Those are engineering discipline problems, and they are exactly what a senior-led build prevents.

Can you take over a half-built Supabase app?

Yes, and it is a common brief. The first step is an audit of the schema, RLS policies, and auth flows, which usually surfaces a shortlist of fixes worth doing before any new features. From there we either harden in place or restructure the data model while keeping your working UI. You get the audit findings in writing either way.

How do you handle Postgres row-level security?

RLS is enabled on every table from the first migration, with policies written alongside the schema and reviewed as part of the build, never bolted on before launch. Service-role access is confined to webhooks and admin surfaces. The policy set ships documented in the repository, so your next engineer can see exactly who can read and write what, and why.

What does a Next.js and Supabase build cost?

Builds run £15-90k depending on scope: a focused MVP with auth and billing sits at the lower end, a marketplace or directory with search, moderation, and programmatic SEO at the upper. Delivery through Claude Code agent workflows keeps the cost well under an equivalent agency team build. Scoping happens in a 30-minute call and you get the range before you commit to anything.

Do you migrate from Firebase or a no-code tool?

Yes. Firebase migrations map Firestore collections to a relational Postgres schema, which usually simplifies the data model considerably. No-code migrations from Bubble or Webflow keep your validated flows and rebuild them on the production stack, with redirects and SEO transport included so you keep the traffic you already earned.

the first call

Describe the product. Leave with a schema opinion and a price range.

Thirty minutes on your product, your data model, and your timeline. If Next.js + Supabase is the wrong stack for it, I will say so and tell you what fits.

book a 30-min call how the delivery works