BoiledPlate vs ShipFast: The Open-Source Boilerplate That Wires Itself

Search "shipfast open source" and you land in the middle of a genre war. ShipFast is the paid Next.js incumbent. ShipFree, Open SaaS, and Supastarter are the free challengers. They all argue about the same thing: which stack ships fastest. That argument misses the point. The stack was never the hard part. The wiring between the pieces is.

BoiledPlate takes a different position. It is a Nuxt + Supabase starter where the setup runs itself: a coding agent interviews you, then provisions Stripe, Supabase, and Google sign-in in one session. Here is how it compares to ShipFast and the open-source field in 2026 — and where each of them still makes you glue services together by hand.

The Real Problem: Stack Choice Isn't the Bottleneck

Ask ten founders how to ship fast and you get ten stack arguments. Next vs Nuxt, Postgres vs a hosted DB, Stripe vs Paddle. Pick what you already know and the debate is over in an afternoon. The framework is not what slows you down.

What slows you down is the plumbing: webhook idempotency, row-level security, refunds, EU consent flows. ShipFast gets the checklist right — payments, auth, UI components, a landing page. What it misses is that those features are the easy 10 percent. The hidden cost of Next.js + Supabase + Stripe is the two to three weeks you spend making them trustworthy together, and that cost is documented, not solved.

BoiledPlate vs ShipFast: Beyond the Feature Checklist

ShipFast's strengths are real. A large community, thousands of shipped products, and the familiar Next.js ecosystem mean you rarely hit a problem someone hasn't already posted about.

Where it falls short is the boring part. Webhook setup is manual. RLS is left to you. Billing edge cases — proration, downgrades, dunning — are exercises for the reader. You read the docs, then you wire it.

BoiledPlate's difference is that provisioning happens in a session, not a reading assignment. Your coding agent doesn't just write code — it provisions the services: Stripe products and webhooks, a Supabase database with RLS, Google sign-in. And Nuxt + Supabase + Stripe is a more cohesive stack than most alternatives, because each piece has first-party integration instead of a community adapter.

Agent-Native Architecture: The Differentiator Nobody Else Owns

"AI-native" gets thrown around loosely. For most boilerplates it means "an agent can read the code." That is table stakes.

BoiledPlate ships an AGENTS.md contract: one documented way to do data access and secrets, so your agent produces consistent output instead of drifting. When it customizes the starter, it applies deterministic patches — repeatable, reviewable changes mapped to your interview answers — not freehand rewrites that bloat the codebase.

This matters because your agent cannot reliably modify a Next.js template the same way twice. Without a contract, conventions are guesses, and two runs produce two different codebases. A documented convention is what makes agent-driven development repeatable.

The Plumbing Nobody Talks About

This is where the "shipfast open source" conversation goes quiet, because it is unglamorous and it is exactly what breaks in production.

• Stripe webhook idempotency. Stripe delivers at-least-once, which means duplicate events are normal, not exceptional. Most docs gloss over this. Your success page should never be the source of truth — the webhook is.
• RLS pitfalls. Auth is the fast part; RLS is the part you forget. A missing policy means tenant A can read tenant B's rows, and you find out in an incident report.
• Refunds and subscription state. Downgrades, cancellations, and refunds all mutate billing state asynchronously.
• EU consent. German law requires an explicit withdrawal-waiver at checkout for instant digital delivery. Skip it and you are non-compliant on your first EU sale.

BoiledPlate solves these in code because this site runs on it. Every edge case above came out of a running log kept while making the plumbing trustworthy.

Billing That Actually Survives Production

Multi-plan Stripe subscriptions are more than a single tier. You need plan changes, proration, and cancellation handling that stays correct when webhooks arrive out of order.

BoiledPlate treats webhook delivery as the source of truth. Handlers are idempotent — a duplicate checkout.session.completed produces no duplicate side effects, enforced with idempotency keys and database unique constraints. The GitHub-invite delivery webhook is a case study in this: some failures must throw so Stripe retries, and some must never throw so you don't loop forever. That distinction is the difference between reliable delivery and a silent retry storm.

Open Source vs Paid: The BoiledPlate Model

Here is where the keyword actually resolves. ShipFast is closed source. BoiledPlate splits the difference honestly.

BoiledPlate Lite is free and MIT-licensed: the same Nuxt 4 app — Supabase auth, Stripe billing, Resend email, blog, i18n — minus the AI tooling. Clone it and wire it by hand. That is genuinely open source where it matters.

Pro is €159 one-time, with lifetime updates and instant GitHub delivery. What you pay for is the agent-driven provisioning: the interview, the deterministic patches, the one-session setup. Against ShipFree, Open SaaS, and Supastarter — all free but none built for agent-driven setup — the paid tier buys back the weeks those free kits still cost you in wiring.

Auth Done Right: Supabase RLS vs Generic Next.js Auth

Row-level security enforces tenant isolation at the database layer, at query time — not in application logic you have to remember to write on every route. Many boilerplates skip it and defend access in middleware, which fails the moment one query forgets the guard.

BoiledPlate ships Supabase auth with RLS on by default, and Google sign-in that provisions user records correctly on first login. The common RLS mistake — a policy that reads auth.uid() but forgets to scope inserts, letting a user write rows for someone else — is exactly the class of bug that database-layer isolation removes.

The Anti-Plumbing Stack

Nuxt gives you first-party integration where Next.js often relies on community adapters. Supabase's RLS pushes security down to the database, cutting a whole category of application-layer bugs. Stripe's at-least-once webhook model is powerful but demands idempotency — it is non-negotiable, not optional. Each tool asks something specific of you, and BoiledPlate answers those demands instead of cutting corners on them.

From Day One: I18n, Blog, and SEO

BoiledPlate ships four languages prebuilt — not a plugin you bolt on and debug later. The blog is prerendered Markdown: fast, searchable, no CMS to run. SEO comes with JSON-LD and og:url canonicals out of the box, which sounds trivial until you hit the failure modes: a JSON-LD source-order bug returning 500 in the browser, or a canonical URL quietly pointing at localhost:3000. TypeScript strict mode catches the rest before production.

Transactional Email Without a Separate Decision Tree

Email is simple to send and annoying to send exactly once. BoiledPlate integrates Resend for verification emails, password resets, and billing notifications. ShipFast and most competitors leave this as a separate provider decision you make later — one more service to wire.

Updates Without Merge Hell

The traditional boilerplate problem: upgrading means resolving conflicts against code you have customized. BoiledPlate ships semantic, agent-readable release notes. Updates are opt-in, and your agent can apply them to customized code without steamrolling your changes — because the AGENTS.md contract tells it what your conventions are.

The Real Cost of Alternatives

ShipFast is $100 upfront, but manual wiring adds two to three weeks. ShipFree, Open SaaS, and Supastarter are free but support agent-driven setup poorly. LaunchFast markets itself as AI-first but ships no AGENTS.md contract, so agent output drifts. The hidden cost across all of them is the same: your time debugging Stripe webhooks, RLS policies, and deployment gotchas.

Deployment: Actually Minutes

BoiledPlate arrives with Supabase, Stripe, and Google OAuth pre-configured — not "ready to wire." Delivery is a GitHub invite, so provisioning is instant rather than a download-and-debug cycle. The gotchas that eat afternoons elsewhere — peer dependency conflicts that break typecheck, missing env vars, mismatched shadcn versions — are handled instead of hunted.

When to Choose BoiledPlate — and When Not To

Choose BoiledPlate if you're comfortable with Nuxt, want to skip Stripe plumbing, build with AI agents, value billing correctness over feature count, and want i18n, a blog, and SEO from day one.

Consider alternatives if you're a pure Next.js shop (accepting you'll wire Supabase and Stripe yourself), you want maximum upfront customization (the Lite tier holds some opinions), or you'd rather stay entirely free with ShipFree or Open SaaS.

Verdict: ShipFast Open Source That Doesn't Make You Wire Stripe Alone

BoiledPlate is the anti-ShipFast: open source where it matters (a real MIT-licensed Lite tier), paid where it saves time (agent-driven provisioning). It is agent-native from the ground up, not bolted on. The billing and the plumbing are handled correctly in code, not deferred to documentation. One session versus weeks of gluing services together.

If you're tired of the boilerplate setup tax, that is the whole pitch — and you can read more on the blog before you buy. For the deeper reading, Stripe's own webhook best-practices guide and the Supabase RLS documentation confirm exactly why this work is worth solving once, properly.