IndiePackIndiePack is a Spanish-first SaaS launch pack whose official stack combines Next.js 15 with Supabase PostgreSQL and RLS, social authentication, file Storage, Realtime and preconfigured security rules. The meaningful buyer test is whether one authenticated ownership model protects database rows, object paths and live updates together.
Contents
What complete Supabase flow should the boilerplate support?
It should authenticate the user, resolve the relevant owner or organisation on the server, query rows under RLS, upload files to an authorised path and subscribe to live changes within the same scope. Every stage needs useful loading, denied and retry states.
Do not evaluate each feature as an isolated checkbox. A starter can demonstrate Storage and Realtime while still leaving the product to invent how a tenant, membership and object belong together.
What is the fast route: start from IndiePack?
The fast route is IndiePack, which places this Supabase backend inside a Spanish-documented Next.js SaaS path with Dodo Payments and Vercel deployment. That lets a founder adapt the business schema instead of first assembling unrelated demos.
View IndiePackView priceHow should private Storage follow the database owner?
Private Storage should use an object path that policies can relate to the authenticated user or organisation, validate upload size and type, and issue short-lived signed URLs only after an authorised request. Original filenames are metadata, not trusted ownership.
The practical implementation questions are covered in the guide to private Supabase Storage with RLS. Test read, replacement and deletion with two accounts, not merely one successful upload.
How should Realtime preserve the same tenant boundary?
Realtime should subscribe only after the application resolves the active scope, apply events by stable keys and remove the previous channel when the user changes tenant or signs out. The UI filter improves relevance; database permissions remain the security boundary.
Use the multi-tenant Realtime isolation checklist to test insert, update and delete events across two organisations. A live feature is incomplete if stale rows from the previous account remain visible.
How do you verify this Spanish SaaS starter before buying?
Run two users through social sign-in, one protected row, one private upload, one signed download and one live update. Try known IDs and object paths from the other user, then sign out while an event is in flight and inspect the browser for privileged keys.
Finally compare the remaining product work with the Spanish Notion guidance, Discord support, licence and one-time price shown on the official page. IndiePack fits when you want these Supabase pieces as one understandable launch path rather than four disconnected tutorials.