for Supabase · free & open source

Ship Supabase apps
that don't leak.

The #1 Supabase footgun is shipping a table with Row-Level Security off. These tools make the safe path the default — scaffold it, gate it in CI, and prove tenant isolation with tests that run against a real database.

Get the free tools →

3 tools live on npm & GitHub · MIT · no signup to start

bash

# scaffold a secure Next.js + Supabase app in one command
$ npx supabase-saas-kit new my-app
✓ auth · Row-Level Security · a test that proves tenant isolation

# gate RLS in CI — fails the build if a table ships exposed
$ npx airlock-rls
✗ payments: RLS DISABLED → exit 1 · this migration does not merge

proven, not hopedTenant isolation is asserted by tests against a real Supabase/Postgres — not mocked.

on every pull requestThe gate fails the build before an exposed table can merge to production.

green in CIEvery tool runs its own test suite against a live database on each commit.

The free tools

Open source, MIT, no signup. Each one makes RLS the default instead of the thing you forgot.

FREE · TEMPLATE nextjs-supabase-starter

Auth + one table with RLS + a test that proves isolation. Clone it and start on your product.

Use this template → FREE · npm supabase-saas-kit

The CLI: scaffold a project, check your env + RLS, and generate migrations that ship RLS-safe by default.

npx supabase-saas-kit new → FREE · npm + Action airlock-rls

The CI gate. Fails your build when a table ships exposed or a policy is permissive. Its paid tier, Airlock Monitor, is below.

npx airlock-rls →

Who it's for

Built for you if…

You ship a Supabase app and can't afford a silent data leak
You're an indie hacker or small team moving fast
You want RLS proven by a test, not hoped for
You'd rather steal a secure setup than roll your own

Not for you if…

You're not on Supabase / Postgres RLS
You don't use migrations or CI at all
You enjoy debugging a tenant-isolation breach in prod

When you're ready to charge customers

The free tools get you shipping. These get you a real SaaS — multi-tenant, billed, secure, and proven. Built and green in CI today; checkout opens the moment our payment processor clears. Reserve the founding price below.

◆ FLAGSHIP · BUILT & PROVEN

The SaaS Boilerplate

Multi-tenant workspaces, auth, the full RLS isolation suite, tests, and deploy — the boring-but-critical foundation, built and proven. Pro adds Lemon Squeezy billing, an admin panel, and web push.

multi-tenant workspacesmember invitesbilling (Lemon Squeezy)admin panel web pushRLS isolation suitee2e + CI + deploy

PAID · BUILT Kit Auth + RLS

Already have an app? Just the security layer: multi-tenant auth + RLS + the isolation suite that proves it. Drop it in.

PAID · BUILT Test Kit

The whole testing pyramid for Next + Supabase: unit, component, e2e, and the RLS isolation harness — as a template.

SUBSCRIPTION · PROVEN IN CI Airlock Monitor

The paid tier of Airlock: watches your live project between CI runs and alerts on RLS drift — the leak the gate can't catch. Its audit→drift→alert cycle is tested against a real Postgres.

Or grab a Combo and save: Frontend, Security, or the whole line. The more you take, the cheaper each piece gets.

Reserve founding pricing

The free tools are yours today. When the paid boilerplate's checkout opens, the list locks in the founding discount — for life. Plus a free Supabase RLS cheat sheet now.

No charge today. You're reserving the price, not buying — we email your checkout once it's live.