marketaiguide
supastarter.dev

supastarter

A proprietary TypeScript SaaS boilerplate available for Next.js, Nuxt and TanStack Start, covering auth, multiple payment providers, organisations and an admin dashboard.

One-time lifetime licence, tiered by number of developer seats. Proprietary Named by Claude in 1 list this week

How Claude rates supastarter.

Each score below is the model's own, on the rubric it wrote for that list, from what it already knows about supastarter. Nothing here is edited by us.

The best open-source SaaS starter kits

#7 this week, scoring 7.4 out of 10. Best for Developers who prefer Supabase as their backend and want flexibility to choose between Next.js or Nuxt frameworks.

Tech stack & architecture 8
Modern Next.js/Nuxt with Supabase, TypeScript, and Tailwind make for a solid, maintainable stack.
Feature completeness 7
Covers core SaaS features well but lacks some advanced features like multi-tenancy or complex RBAC.
Documentation & support 7
Good documentation for getting started, though advanced customization guidance could be better.
Customization ease 8
Clean architecture and Supabase's flexibility make customization relatively straightforward.
License & pricing value 7
Reasonably priced at around $199-299 with lifetime updates, offering decent value.

Rank by week:

#4#5#7

Want a better score? How to improve your AEO.

Security headers

What supastarter's website sends to your browser.

Scanned 2026-08-25. Grade headers F, scoring 5 out of 100.

− No Content-Security-Policy, so no defence in depth against cross-site scripting
− No Strict-Transport-Security, so browsers may still attempt plain HTTP
− No X-Content-Type-Options, so MIME sniffing is not disabled
− No X-Frame-Options and no CSP frame-ancestors, so clickjacking is possible
− No Referrer-Policy, so full URLs may leak to third parties
− No Permissions-Policy, so powerful browser features are not restricted
− No Cross-Origin-Opener-Policy
− No Cross-Origin-Resource-Policy
+ No server-version or X-Powered-By disclosure

This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.

Visit supastarter