Next.jsReactSaaSStarter

cinderblock — Next.js SaaS Template

By philiprehberger

A forkable multi-tenant SaaS starter built on Supabase and Next.js, centered on a pgtap row-level security (RLS) policy test suite run against a hostile multi-tenant data fixture.

Open Source Site Download Source ZIP

Explore the design

Compare the page layouts and mobile experience. Open any screenshot for a closer look.

2 previews

Desktop homepage1 / 2

Visit websiteOpens in a new tab

Desktop captureTop of page

Actual screenshot captured by the server browser.

All pages & views 2

Screenshots show visual appearance; interactive behavior may differ.

Recorded 2026-10-07View source

What stands out

A quick read of the recorded project description.

Ships with 74 pgtap row-level security policy tests against a hostile fixture of 5 workspaces × 8 users × all roles × all tables

Postgres data model covering workspaces, members, roles, invitations, audit, and billing

Supports magic links, Google OAuth, and TOTP multi-factor authentication for owners

Admin impersonation uses a server-issued 60-minute HS256 JWT, with step-up authentication at entry and audit events recorded twice

Stripe Checkout and Customer Portal integrated in test mode, with insert-first idempotent webhooks

Provides a live policy viewer that reads pg_policies and a page showing the latest pgtap results

Template Details

Cinderblock is a forkable multi-tenant SaaS starter template that runs on Supabase and Next.js. Its focus is not the interface but data isolation: the repository ships with a suite of 74 pgtap policy tests that run against a hostile fixture of 5 workspaces × 8 users × all roles × all tables. Cross-tenant queries should return 0 rows, and any single leaked row fails the tests.

The data model covers workspaces, members, roles, invitations, audit, and billing, built on Postgres. Authentication methods include magic links, Google OAuth, and TOTP multi-factor authentication for owners. Administrators can perform impersonation backed by a server-issued 60-minute HS256 JWT, with step-up authentication required on entry and audit events recorded twice. Audit writes go through a direct cb_audit_writer Postgres connection rather than an Edge Function round trip.

Billing integrates Stripe Checkout and the Customer Portal, running in test mode, with webhooks handled idempotently by insert-first, seat limits enforced via deferred triggers, and two states: past-due grace and read-only after cancellation.

The repository also provides two online documentation pages: /docs/security/policies reads pg_policies from the deployed database to show live policies, and /docs/security/test-results displays the most recently captured pgtap output. The README states that the pgtap suite is the core artifact and that `npx supabase test db` can reproduce green results in your own fork.

Limitations: the template depends on external services such as Supabase and Stripe, which may charge separately; third-party assets such as demo images, fonts, and icons must be checked against their respective licenses. The first-run time and post-cache speed figures in the README are the author's own claims and were not independently verified in this material.

Next.jsSaaSStarter

Is it right for your project?

Use Cases

SaaS projects that need to verify multi-tenant data isolation policies actually work
Building a workspace, member, role, and invitation system with Supabase as the backend
Back-office systems that need audit logs and admin impersonation
Scenarios planning to integrate Stripe subscription billing and requiring idempotent webhook handling

Suitable For

Developers familiar with Next.js and Supabase who are willing to configure external services themselves
Teams that treat row-level security and cross-tenant isolation as their primary evaluation criteria
Projects that need to fork and run the security test suite themselves

Getting started & customization

Use these recorded setup notes alongside the repository instructions for your chosen version.

1
After cloning the repository, run npm install, then ./scripts/postclone.sh (or npm run postclone), and finally npm run dev
2
postclone.sh starts Supabase, applies migrations, generates the cb_audit_writer and cb_impersonator passwords, generates the Edge Function HMAC key, and runs the pgtap suite; any failure exits non-zero
3
The first run needs to pull the Docker images for supabase start, which the README says takes about 10–15 minutes; subsequent runs are faster
4
External services such as Supabase and Stripe may incur additional costs, and you need to prepare accounts and keys yourself
5
Third-party assets such as demo images, fonts, and icons must be checked separately against their respective licenses

Read repository instructions

License & source material

Usage conditions & limitations

Free to use · keep license notice

This entry covers the free version under the MIT license in the public repository; the free scope is that version's code and does not mean external services or third-party assets are free.

Must comply with when using

You may use, modify, commercialize, and distribute this version's code for free.
When distributing copies or substantial portions of the code, retain the original author's copyright notice and the full MIT license notice.
The code is provided as is; warranties and limitations of liability are governed by the original license and applicable law.

Additional costs & items to verify

Demo images, fonts, icons, and other third-party assets must be checked against their respective licenses and cannot be judged solely by the code's MIT license.
External services such as domains, hosting, databases, payments, or AI may charge separately.
Stripe billing is integrated only in test mode; accepting real payments requires configuring your own Stripe account and keys and may incur external service fees.
The template depends on the external Supabase Cloud service, which requires registering an account and may incur costs.
The first run requires pulling Docker images and takes about 10–15 minutes, and a local Docker environment is required.

View Original Text Basis

Permission is hereby granted, free of charge
Original License Text

Stripe Checkout + Customer Portal wired in test mode with insert-first webhook idempotency.
Original README

Supabase Cloud (Postgres 17, Auth, Edge Functions, Storage, Realtime)
Original README

First run is 10–15 minutes (Docker image pull for `supabase start`).
Original README

https://github.com/philiprehberger/cinderblock/blob/main/LICENSE https://github.com/philiprehberger/cinderblock/blob/main/README.md

Compiled by DeepSeek based on repository license and README ·2026-10-07. Results only cover the materials read; dependencies, images, fonts, and subsequent term changes are subject to their respective original texts.

Project checks & description sources

Template Information

Source platforms: GitHub
Documentation and maintenance reference score: More documented · 88 / 100
Technologies: Next.js · React
Website type: SaaS · Starter

How this score is calculated

Our heuristic uses license records (up to 30), a demo link (12), a preview (10), stars (15), recorded maintenance (15), description completeness (8), feature records (5) and classification data (5). It is not a code, security or performance test, or a Google score. A link does not establish tested functionality.

What to verify for this project

Repository update recorded: 2026-09-28
Screenshot last checked: 2026-10-07

A demo link is listed. Check it with your own content and viewport sizes; its presence does not confirm that forms, authentication or payments work.

The catalog identifies Next.js as the primary stack. Check the actual dependency manifest and lockfile for versions and hosting requirements. These notes use recorded metadata, not a code audit or a deployment test.

Use a selection guide →

How this description was prepared

AI-assisted description based on catalog records and repository material. Repository authors are not automatically the reviewers of this description.

Review declaration: [email protected] · 2026-10-08

Inspect the recorded source material

SHA-256: b73aebb0c2458ee176cad8635495f2b1e04c7ca2e8bcc4f152e9781271e22468

2026-10-07T19:06:29.002Z

Source file / repository

# Cinderblock

The forkable multi-tenant SaaS starter on Supabase whose load-bearing differentiator is a pgtap-tested Row-Level-Security suite that survives hostile multi-tenant fixtures.

Most Supabase multi-tenant deliveries trust the client to send the right tenant ID, use the service-role key to bypass RLS "for performance," or write policies that pass against the owner's own data and silently leak under joins. Cinderblock doesn't.

## What you get

- Workspace + member + role + invite + audit + billing data model on Postgres.
- 74 pgtap policy tests against a hostile fixture (5 workspaces × 8 users × every role × every table). Cross-tenant attempts return 0 rows; the tests fail loudly if a single row leaks through.
- Magic-link + Google OAuth + TOTP MFA on owners.
- Admin impersonation with a 60-minute server-minted HS256 JWT, step-up auth on entry, and double-logged audit events.
- Stripe Checkout + Customer Portal wired in test mode with insert-first webhook idempotency. Seat enforcement deferred trigger. Past-due grace + canceled read-only modes.
- A direct `cb_audit_writer` Postgres connection for append-only audit writes (no Edge Function round-trip per server action).
- `/docs/security/policies` — a live RLS policy viewer that reads `pg_policies` on the deployed database.
- `/docs/security/test-results` — the latest captured pgtap output.

The pgtap suite is the load-bearing artifact: `npx supabase test db` produces a green run a prospect can reproduce in their own fork in under a minute (warm cache).

## Quick start

```bash
git clone https://github.com/philiprehberger/cinderblock.git
cd cinderblock
npm install
./scripts/postclone.sh    # or `npm run postclone`
npm run dev
```

`postclone.sh` is idempotent — it boots Supabase, applies migrations, generates passwords for `cb_audit_writer` + `cb_impersonator`, generates Edge Function HMAC secrets, runs the pgtap suite, and exits non-zero if anything is red.

First run is 10–15 minutes (Docker image pull for `supabase start`). Subsequent runs are under a minute.

## Docs

- [Overview](https://cinderblock.philiprehberger.com/docs)
- [Getting started](https://cinderblock.philiprehberger.com/docs/getting-started)
- [How RLS works](https://cinderblock.philiprehberger.com/docs/security/rls)
- [Live policy viewer](https://cinderblock.philiprehberger.com/docs/security/policies)
- [Test results](https://cinderblock.philiprehberger.com/docs/security/test-results)
- [Audit log + impersonation](https://cinderblock.philiprehberger.com/docs/security/audit-log)
- [Policy evaluation cost](https://cinderblock.philiprehberger.com/docs/security/policy-cost)
- [Disclaimer](https://cinderblock.philiprehberger.com/docs/security/disclaimer)
- [Stripe wiring](https://cinderblock.philiprehberger.com/docs/billing/stripe)
- [Swap to Vercel](https://cinderblock.philiprehberger.com/docs/swap-vercel)

## Stack

- Next.js 16 (App Router) + React 19 + Tailwind 4 + TypeScript strict
- Supabase Cloud (Postgres 17, Auth, Edge Functions, Storage, Realtime)
- Stripe (Checkout + Customer Portal + webhook idempotency)
- pgtap for the security suite, Vitest for TypeScript units, Playwright for E2E

## License

MIT. See [LICENSE](./LICENSE).

Report a correction

Explore similar templates

Compare previews and descriptions within the same stack and category.

Next.js SaaS Starter

The official Next.js SaaS starter template, integrating email/password authentication, Stripe Checkout subscriptions, a dashboard with user/team CRUD, basic Owner/Member RBAC, and activity logging.

Next.js · SaaS

Next.js Commerce

Vercel's officially maintained Next.js App Router ecommerce starter with deep Shopify integration, offering a complete product catalog, cart, and checkout flow. Core logic is modular for swapping backends, and community provider versions exist for BigCommerce, Medusa, and Saleor.

Next.js · E-commerce

Next-js-Boilerplate

A developer-first Next.js 16 starter with Tailwind CSS 4 and TypeScript, supporting both App Router and Page Router.

Next.js · Starter

tailwind-nextjs-starter-blog

A Next.js and Tailwind CSS blog starter template using Contentlayer for Markdown/MDX, with built-in SEO, code highlighting, and tags. It targets personal technical blogs and migration from Jekyll/Hugo to React, and supports one-click Vercel deployment.

Next.js · Blog

next-forge

next-forge is a Turborepo-based Next.js template maintained by Vercel, positioned as a starting point for SaaS products.

Next.js · Starter

SaaS-Boilerplate

SaaS-Boilerplate is an open-source SaaS starter template built with Next.js App Router, React 19, TypeScript, Tailwind CSS, and Shadcn UI.

Next.js · SaaS