Open Sourced webapp shell for vibe coders

Open-sourced something (MIT) that might save you a boring week.

Every time someone vibe-codes a prototype with Claude Code or Cursor, the demo works, then they hit the same wall: real auth, roles, and actually-secure data access. Most people end up hiding buttons in the UI and calling it security. One open DevTools and it's gone.

So I built a Next.js + Supabase starter that handles that part properly:

Google OAuth, no passwords to store
Three roles out of the box: admin, manager, viewer
Security enforced at the database with RLS, not in the UI. The database refuses the write. That's the difference.
CSP and security headers preconfigured
CI/CD on every PR, one-click Vercel deploy

It's the layer between "the prototype works" and "I can let real users in."

link

Free to fork. I'd genuinely like eyes on it, tell me what you'd change, what's missing, or where the security model could be tighter. PRs welcome.

What do you normally reach for to handle this part?

2 comments