Introduction
GStack is an opinionated starting point for multi-tenant, role-aware SaaS built on Nuxt 4 and Supabase. It is distributed as a GitHub template repository: click Use this template, run one rename command, and it's yours.
Principles
RLS-first security
Access control lives in Postgres Row Level Security, not in application code. Page-level role gates are UX only. A bug in a component can never leak another tenant's data, because the component never had the rows.
Type-safe end to end
Database schema → generated types → composables → UI. A query that under-selects
fails at pnpm typecheck, not in production.
Batteries included, but flag-gated
Notifications, observability, email, billing, analytics, feedback and the onboarding tour are all wired and all off by default behind env flags. Nothing half-works — you flip one switch per subsystem. A bare clone runs with no third-party account at all.
Generic and rebrandable
No product identity is baked in. node scripts/rename.mjs "My App" swaps the
display name everywhere it appears; there is one brand palette to change.
DX over cleverness
Boring, legible code. The laziest solution that actually works. Deletion over addition.
Non-goals
- Not a no-code platform.
- Not framework-agnostic — it is Nuxt + Supabase, deliberately.
- Not a kitchen sink. Every dependency earns its place or is cut.
How it compares
| vs. create-t3-app | Same type-safety ethos, but RLS-first Postgres instead of app-layer authz, and Vue/Nuxt instead of React/Next. |
| vs. commercial Nuxt SaaS kits | Matches them on auth, i18n and testing; ahead on observability, accessibility, release automation and proven multi-tenancy. |