Be Social — Social Platform Boilerplate (Next.js 15 + Supabase)

A complete social platform foundation you can launch on, not a collection of components you still have to wire together. Every feature listed below works against a real Postgres database with row-level security, reproducible migrations, and a live demo running the exact code you receive.

Get the Mobile App here: https://zerotohundred.ai/listings/be-social-mobile-x1gsod

What works out of the box

Content — Compose posts with text, images, video, GIFs and camera capture. Automatic link previews via Open Graph scraping. YouTube and X/Twitter embeds. 15 categories, hashtag extraction, @mention autocomplete. Edit within 10 minutes, soft delete.

Engagement — Four reaction types with optimistic updates. Threaded comments using the Facebook/Instagram pattern: one level of indentation with "Replying to @name" attribution beyond that, so long threads stay readable at 375px. Reposts appear on profiles and surface to followers with attribution. Private bookmarks with a Saved tab. Follows with a suggested-accounts panel. Trending hashtags over a rolling 7-day window.

Accounts — Email/password and Google OAuth via Supabase Auth. Profiles are created automatically on signup by a database trigger, with a complete-profile step for OAuth users. Avatar and banner upload, bio, location, website. Settings for profile, theme and notification preferences.

Realtime notifications — In-app notifications over Supabase Realtime, with unread badges in the sidebar and mobile nav.

Moderation — Block and mute, applied consistently across feed, search and comments. Report posts, comments and profiles.

Billing (optional) — Stripe Checkout for subscription plans defined in a single file, plus a webhook receiver that keeps a local subscriptions table in sync. Leave it unconfigured and the upgrade page shows plans as "coming soon" rather than erroring.

How it is built

Next.js 15 App Router, React 19, TypeScript throughout. Supabase for Postgres, auth, file storage and realtime. Drizzle ORM as the schema source of truth. Tailwind v4 with a three-layer token system (primitives → semantic → theme) so rebranding is one file. TanStack Query for server state with optimistic updates.

Fourteen runtime dependencies. No UI library, no Redux, no CSS framework beyond Tailwind — nothing you have to unpick.

Security is not an afterthought. Row-level security on every table. Denormalised counters are maintained by database triggers rather than client-callable functions, so nobody can inflate a post's like count by calling an endpoint in a loop. Trigger functions have EXECUTE revoked so they never appear on the REST API. The Content Security Policy is generated from your own environment at build time.

Setup

Ships with AGENTS.md — an ordered runbook written to be handed straight to a coding agent. Every environment variable with its exact dashboard location, verification queries to run after the migrations, and a failure table mapping real error strings to their causes. Three migrations, one command. The README covers the same ground as reference documentation, including a third-party services table showing exactly which services are required (only Supabase) and which are optional.

Dark and light themes with no flash on load. WCAG AA contrast verified. Keyboard navigation and skip links. Responsive to 375px. No image assets anywhere — icons and avatars are inline SVG, so there is nothing to re-export when you rebrand.

What is NOT included

Stated plainly so there are no surprises after purchase:

• No admin dashboard. Reports are stored and exposed over an API; moderating them means building a UI or working in the Supabase dashboard.
• No transactional email. Supabase sends auth emails; digests and mention notifications are not wired.
• No direct messages.
• No feed ranking algorithm. Feeds sort by recency or a simple time-decay score. There is no personalisation.
• No rate limiting. Add Upstash or a WAF before opening signups.
• No test suite.
• No mobile app. Web only, responsive.
• No internationalisation. Copy is hardcoded English.
• Polls exist in the post-type enum but have no UI.

Requirements

Node.js 22 or newer, pnpm 9, and a Supabase account. The free tier is enough to run it. Google sign-in, GIF search and Stripe are each optional and stay switched off until you configure them.

You receive the full source with no credentials of ours anywhere in it — every value in .env.example is a placeholder for your own.