Ship Supabase apps that don't leak.

Security-first tooling and boilerplates for Next.js + Supabase — the layer that proves your tenants are isolated, not just assumes it. Every piece ships with a test that fails the build if Row-Level Security has a hole.

• airlock-rls — the CI gate for Supabase RLS. Fails your build if a table ships without RLS or a policy is permissive. On the GitHub Marketplace.
• nextjs-supabase-starter — secure-by-default starter: auth + owner-scoped RLS + a test that proves isolation.
• saas-kit — companion CLI: scaffold, RLS doctor, migrations, pre-deploy checks.

The complete multi-tenant SaaS boilerplate — workspaces, auth, the RLS isolation suite proven by tests, billing, admin panel, deploy — lives at shipsealed.com.

Built by @mateuszingano · shipsealed.com