## TL;DR verdict **Supastarter** is the best-supported Supabase-native candidate from the original list. Its current product page documents organizations, invitations, roles, billing providers, file storage, notifications, internationalization, admin tooling, and monorepo modules. The rest of the original shortlist needs correction. **Open SaaS** is a free Wasp/React/Node/Prisma boilerplate with auth, payments, background jobs, and S3 uploads; it is not documented as Supabase-native. The linked Next SaaS Starter repository is unavailable, ShipFast's claimed Supabase implementation conflicts with StarterPick's structured data, and no approved source supports the T3-as-Supabase recommendation.

## Key takeaways - Supabase's Postgres foundation supports policy-based access control through **Row Level Security**. Review actual policies, not just a “uses Supabase” label. - Supastarter documents a broad Supabase-native SaaS feature set. Confirm implementation details in purchaser documentation before buying. - Open SaaS uses **Wasp**, React, Node, and **Prisma**, with **S3** uploads. Calling it a Supabase-native starter would be inaccurate. - Supabase Free includes **50,000 monthly active users**. Pro **starts from $25** per month and includes **100,000 monthly active users**. - Makerkit's current product page also documents Supabase-native auth, storage, database, Row Level Security, organizations, invitations, and RBAC, now with React Router 8. It is correction evidence, not a new ranked card in this frozen shortlist. - Setup times, ROI, popularity, follower counts, star counts, broad maintenance claims, and unverified quota details were removed.

## At a glance | Original order | Current evidence status | Decision | | --- | --- | --- | | 1. Supastarter | Current Supabase-native product page | Evaluate for an assembled multi-tenant SaaS stack | | 2. [Open SaaS](https://github.com/wasp-lang/open-saas) | Current official repository; not Supabase-native | Consider only as a separate Wasp/Prisma option | | 3. [Next SaaS Starter](https://github.com/mickasmt/next-saas-starter) | Frozen URL unavailable | Remove from the evaluated set | | 4. ShipFast | Supabase support unresolved | Hold; **verify purchaser documentation** | | 5. [T3 Stack](https://github.com/t3-oss/create-t3-app) | No approved source for the former Supabase claim | Remove from the evaluated set | The table keeps the guide's original organic order without converting held or removed candidates into claims.

## Evidence cards ### 1. Supastarter: documented Supabase-native candidate Supastarter's official page documents organizations, invitations, roles, billing through providers including Polar and Stripe, file storage, notifications, internationalization, admin tooling, and monorepo modules. It also presents the database and auth layer as Supabase-native. That public feature shape is enough to shortlist it, but not enough to assume every policy or workflow matches your application. Before buying, inspect tenant isolation, invitation acceptance, role changes, billing ownership, storage policies, and the modules included in the current package. Exact Supastarter prices and time-saved claims are intentionally omitted. ### 2. Open SaaS: useful correction, not a Supabase pick Open SaaS is documented as a free Wasp/React/Node/Prisma SaaS boilerplate. Its repository lists authentication, payments, email, background jobs, and S3 uploads. The former “Supabase as Postgres host” framing was removed because the official repository does not establish it. The old shortcut “add S3 later” also needs care: Open SaaS already documents S3, but S3 is not Supabase Storage. Evaluate Open SaaS on its actual stack rather than stretching it into this category. ### 3. Next SaaS Starter: removed The protected repository URL currently does not provide a canonical project to verify. Its former card, license, framework version, Supabase authentication claim, payment claim, and star count are removed until a current official repository is found. ### 4. ShipFast: held pending purchaser documentation The existing guide described a ShipFast Supabase option, while StarterPick's structured metadata records NextAuth and MongoDB. This guide does not resolve that conflict by guessing. Verify purchaser documentation for the exact auth and database adapters before considering ShipFast for this use case. ### 5. T3 Stack: removed from the Supabase shortlist No approved T3 source establishes that the project commonly uses Supabase or supports the former popularity claim. The protected repository link remains in the table, but the product receives no Supabase recommendation. ### Current alternative evidence: Makerkit Makerkit's current product page documents Supabase-native auth, storage, database, and Row Level Security plus multi-tenant organizations, invitations, and RBAC. It now advertises React Router 8. This corrects the old implication that Supastarter alone provides prewritten Supabase tenant and storage controls; it does not change the frozen five-item organic order.

## Methodology We preserved the original order and required current official evidence for every product capability, price, version, license, availability, quota, and maintenance claim. A missing or conflicting source results in a held or removed card. We did not use stars, followers, setup estimates, revenue bands, or vendor ROI claims. For a Supabase starter, inspect: 1. Which system owns authentication and user identity. 2. How organizations and memberships map to Postgres rows. 3. Which exposed tables have Row Level Security enabled and what each policy permits. 4. Whether file storage and S3 references point to the same service or different ones. 5. Which billing customer owns a subscription and how webhook changes update access. Supabase's RLS documentation explains that policies act as a rule engine for table access. A starter's security value depends on the policies it actually ships and tests; this guide does not claim that missing policies make a leak inevitable or assign a dollar value to prewritten policies.

## Source-backed FAQ ### What current Supabase allowances matter for an early SaaS? The official pricing page lists **50,000 monthly active users** on Free. Pro **starts from $25** per month and includes **100,000 monthly active users**. Check the current page for every other allowance because database, egress, storage, backup, and support categories are distinct and can change. ### Is Open SaaS built on Supabase? Not according to the approved official repository. It is a Wasp/React/Node/Prisma boilerplate with auth, payments, jobs, and S3 uploads. ### Does Supastarter include multi-tenancy? Its public page documents organizations, invitations, and roles alongside its Supabase-native modules. Inspect purchaser documentation to confirm the policy and billing model fits your tenants. ### Is ShipFast a verified Supabase boilerplate? Not in this evidence set. The guide's former claim conflicts with repository structured data, so confirm the implementation in current purchaser documentation. ### Why does Row Level Security matter? Supabase exposes Postgres data through APIs, and RLS policies determine which rows a request can access. Review policies for every exposed table and test them under authenticated and unauthenticated roles.