ShipFast Company: Why Stack Choice Doesn't Matter

Ask ten founders which "shipfast company" or boilerplate to buy and you'll get ten stack arguments. Next.js or Nuxt. Postgres or a hosted database. Stripe or Paddle. The debate feels important. It isn't. The stack takes an afternoon to settle. The weeks disappear somewhere else entirely — and that's the part almost nobody sells you honestly.

The Real Cost of SaaS Setup: Why Stack Choice Isn't Your Bottleneck

The Stack Debate Is a Distraction

Whatever framework you already know is the right framework. That decision is done in a day. What actually eats your launch is the wiring between services: Stripe webhooks, row-level security rules, an email provider that sends exactly once, EU consent flows. This is the plumbing, and it's invisible until it breaks in production.

We know because we built BoiledPlate by writing that plumbing, then keeping a running log of every edge case it took to make it trustworthy. This site runs on it. The premise is simple: stop re-wiring the same plumbing for every new project.

What "Ship in Days" Actually Means

Shipping boilerplate code is table stakes — every template does that. The real move is shipping configured services in a single session: Stripe products created, Supabase auth live, Google OAuth wired, webhooks registered.

That's where agent-driven setup beats manual wiring. Your coding agent interviews you, then applies deterministic patches to reshape the codebase to your answers. No human fat-fingering a secret into the wrong file, no half-configured webhook endpoint discovered three weeks later.

The Boilerplates Landscape

Next.js templates like ShipFast are battle-tested with large communities and proven market fit. If you're already deep in Next.js, that ecosystem serves you well. The Nuxt + Supabase angle is quieter but has a stronger TypeScript story, and Supabase's RLS is non-negotiable for multi-tenant SaaS. The other axis is free versus paid: BoiledPlate Lite is MIT-licensed and you wire it manually; Pro automates the actual pain with an agent.

The Webhook Architecture Nobody Wants to Build

Why Stripe Webhooks Are the Source of Truth

Client-side success pages lie. A user closes the tab before the redirect, or the network hiccups, and your UI says "paid" while your database says nothing happened. Webhooks don't lie — they're the source of truth for billing state. Your checkout success page should never touch your billing state.

The hard requirement is idempotency: the same event, delivered multiple times, must produce exactly one state change. Naive implementations fail on race conditions, retries without deduplication, and database deadlocks.

Building Idempotent Webhook Handlers

The pattern is straightforward to describe and easy to get wrong: store the Stripe event ID as an idempotency key before running any side effects. Refund flows are where this bites — the refund webhook can arrive before the subscription-cancelled event, so your state machine has to handle out-of-order delivery.

Real failure modes production hits: webhook workers that crash mid-transaction, partial state updates, confirmation emails sent twice. Our own delivery webhook has a deliberate design where some failures throw (so Stripe retries) and some never do (so you don't spam the customer).

Multi-Plan Subscription Management at Scale

Single-plan setups are a lie the demo tells you. Trials, downgrades, pro-rata credits, and seat-based pricing all break simple logic. Each event — customer.subscription.updated, invoice.payment_succeeded, charge.dispute.created — triggers a different code path. Testing means the local Stripe CLI, replay fixtures, and deliberately dropping events to see what survives. The five decisions behind Stripe subscriptions walk through the order that actually holds up.

AI Agents and Consistency

The AGENTS.md Contract

Without conventions, agents drift. Each run produces slightly different naming, structure, and error handling. Documentation becomes a guard rail: here's how we fetch data, here's where secrets live, here's how API routes and errors are shaped. The agent reads the contract, then applies targeted patches to match your answers. We wrote more about writing conventions for the agent, not the next hire.

Why Agent-Driven Setup Survives Customization

Traditional templates: clone, edit 47 config files, pull a new version, enter merge hell. The BoiledPlate model instead interviews you, applies semantic patches, and delivers via GitHub instantly. When updates ship, semantic release notes tell you exactly what changed and why. Shipping the stack was never the hard part.

The Cost of Agent Drift

Two concrete failures we've seen: an agent generating RLS policies in different syntax each run, so Supabase rejects half of them; and secrets scattered across .env, a config file, and the database, so the agent can't reliably find them. The fix is one source of truth in AGENTS.md that the agent validates against before committing.

Billing Edge Cases That Production Hits

If you sell in the EU, this is not optional. German law lets customers withdraw digital-purchase consent unless they've explicitly waived it. The naive approach — a refund button that hits Stripe immediately — leaves you exposed. We encoded a German withdrawal waiver into the pay button using Stripe Checkout's consent_collection, so consent is captured at purchase, not argued about later.

Subscription Lifecycle Management

When does billing actually start after a trial? Stripe's date fields are genuinely confusing. Mid-cycle downgrades generate pro-rata credits that Stripe calculates but you must display correctly. And churn prediction needs usage patterns — webhook data alone won't tell you who's about to leave.

Refund Flows That Don't Explode

Partial refunds compound fast: a customer gets a $50 credit, applies it, then requests a full refund. What's owed? Worse, a refund can succeed while the confirmation email silently fails — now support gets five tickets for one refund. The fix is the same trio every time: idempotent webhooks, transactional email with retries, and an audit log of every state change.

Row-Level Security: Billing Logic at Query Time

Why RLS Isn't Optional for Multi-Tenant SaaS

Without RLS, you rely on application code to filter by user_id. One bug and a customer sees someone else's invoices. With RLS, the database rejects the query outright — no code path can leak data. The tradeoff is performance: policies run at query time, so a slow policy slows every query.

RLS Policies for Stripe-Driven Billing

A clean split: select lets customers see only their own invoices and subscriptions; update forbids customers touching billing records directly — only webhooks write them; insert opens a narrow onboarding window that the webhook then locks. Auth is the fast part of Supabase; RLS is the part you forget.

The Pattern

User signs in with Google OAuth (Supabase handles it). RLS policies tied to auth.uid() scope every query automatically. The Stripe webhook arrives with a customer ID, the handler writes state using the server key, and RLS enforces who can read it.

Technical Debt and Real-World Debugging

JSON-LD Hydration Crashes

Our prerendered Markdown blog once returned 200 from the server and 500 in the browser — a hydration mismatch that lived in source order. The lesson: use useAsyncData with proper caching and avoid dynamic context during SSR.

Canonical URLs Without Head Drift

Every page needs a canonical link and og:url. Base URLs differ between dev, preview, and production, so you can't hardcode them. We learned this the hard way when our blog told Google its canonical URL was localhost:3000.

Peer Dependency Hell

Upgrading one package breaks types in another, and TypeScript strict mode surfaces all of it — sometimes in surprising places, like @vercel/analytics breaking nuxt typecheck. BoiledPlate ships a validated dependency tree; upgrading safely means re-running the agent, not a hopeful npm install.

The Anti-Plumbing Stack: Why These Tools Together

Nuxt gives you full-stack SSR with Nitro for API routes and less glue than Next.js for small teams. Supabase gives you hosted Postgres with RLS, Auth, and Realtime — and no lock-in, since you can export your database anytime. Stripe is the billing standard that takes weeks to replicate. Resend treats transactional email as code.

Each demands something: Nuxt wants you to understand composables versus middleware; Supabase RLS is database code that's harder to test than app code; Stripe's retry logic is a contract you can't ignore. And there are gaps this stack leaves open — analytics (bring PostHog), observability (Sentry), file uploads (S3 or Cloudinary), and job scheduling — that you'll integrate yourself.

Product Delivery as Plumbing

The GitHub invite is the product. A customer buys, the charge.succeeded webhook hits the backend, and the backend creates a private repo from the template and invites them — repo URL in their inbox within seconds. That beats a zip file every time: version control built in, CI/CD ready, code inspectable before running.

Versioning stays honest with semantic, agent-readable notes. Patch releases fix bugs without touching customizations. Minor releases add features and re-run patches. Major releases are opt-in re-interviews when you actually want the new capability.

Free vs. Paid

BoiledPlate Lite is free and MIT-licensed: everything a Nuxt + Supabase boilerplate needs, but you wire Stripe, Google Auth, and Supabase yourself — roughly 3-4 hours per new project.

BoiledPlate Pro is €159 one-time: the agent interviews you, provisions the services, and delivers a customized private repo instantly, with lifetime updates. Effort: a 15-minute session.

The ROI math is honest. Ship one SaaS a year and Lite is fine. Ship four or more and Pro pays for itself on the second project. Work with a coding agent daily and the AGENTS.md contract alone saves debugging hours.

Competitive Landscape

ShipFast (Next.js) has the larger community and richer integration ecosystem. BoiledPlate leans into type safety, agent-native setup, and an RLS-first billing model. Neither is strictly better — there's room for both. Pick BoiledPlate when you're already comfortable with Supabase, you use Nuxt, you build with Claude, and you need multi-plan Stripe billing with idempotent webhooks.

Shipping Without Excuses

Validation is free. Shipping is free. Excuses aren't. BoiledPlate removes the "set up boilerplate" excuse — you still have to write your product. The path is short: interview, provision, customize, deploy. The framework was never what slowed you down. The plumbing was. Once it's done, the only thing left is the part that was always yours: building.