Full-stack platform for an exclusive community of women entrepreneurs with 51 routes, AI matchmaking, realtime messaging and 40 tables with Row Level Security
- 51
- App routes
- 40
- Tables with RLS
- Low
- Serverless stack
Client
SEEDS Experience
Sector
Community · Entrepreneurship · Networking
Timeline
Projeto contínuo · 2026-08
Live product
Use nowResults
Client-reported results during rollout
Baseline: 0
Fonte: page.tsx + route.ts in src/app
Baseline: 0
Fonte: supabase/migrations — unique CREATE TABLE
Baseline: 0
Fonte: schema.sql — CREATE INDEX
Baseline: 0
Fonte: Groq + Gemini + Cerebras in API routes
Baseline: 0
Fonte: src/app/(dashboard)/app — directories
Baseline: 0
Fonte: src/app/(admin)/admin — directories
Client-reported data
The challenge
The challenge
An entrepreneur receives an exclusive invite by email. Clicks the magic link. In seconds, she is authenticated and inside a platform with a social feed, directory of other verified entrepreneurs, events with RSVP, realtime messaging, capital opportunities, learning tracks and an AI assistant that matches complementary profiles. All running on Cloudflare Workers with Supabase as backend, with no infrastructure cost.
A SEEDS Experience precisava de uma plataforma digital que suportasse uma comunidade exclusiva de mulheres empreendedoras com networking verificado, matchmaking por IA, eventos com RSVP, mensageria em tempo real, fórum, trilhas de aprendizado, gamificação com conquistas, diretório de membros, oportunidades de capital, benefícios de parceiros e moderação administrativa. O sistema precisava ser invite-only, com autenticação por magic link, Row Level Security em todas as tabelas e performance em produção sem custo elevado de infraestrutura.
The approach
The approach
We architected a full-stack application with Next.js 15 App Router and Supabase as the complete backend. The database was modeled with 40 tables distributed across 8 functional groups: core, social, events, business, learning, communication, recognition and moderation. Row Level Security enabled on all tables with per-user policies. Automatic triggers for reaction, comment and save counters. Over 40 indexes including composite and partial. Invite-only authentication via magic link with invites table. Realtime via Supabase for messages and rooms. Storage for avatars, feed images and event covers. AI integrations with Groq, Gemini and Cerebras for matchmaking and assistant. Deploy on Cloudflare Workers via @opennextjs/cloudflare for zero infrastructure cost.
The solution
The solution
The SEEDS Experience platform is a complete full-stack application with 51 routes, 40 tables with RLS, realtime messaging, 3 AI integrations and a complete admin area — all deployed on Cloudflare Workers with Supabase as backend.
- 51 routes: 4 public (home, login, privacy, auth/callback), 26 protected under /app/* (feed, events, directory, connections, collaborations, forum, groups, messages, referrals, testimonials, benefits, capital, AI, match, wall, notifications, speakers, partners, profile, products, ranking, saved, tracks, jobs, history) and 9 admin under /admin/* (invites, events, import, reminders, members, metrics, moderation, partners)
- 40 tables with RLS enabled: profiles, invites, privacy_settings, connections, groups, group_members, feed_posts, feed_post_reactions, feed_post_comments, feed_post_saves, hashtags, feed_post_hashtags, feed_post_mentions, events, event_attendees, editions, speakers, collaboration_posts, partners, sponsorships, products, jobs, capital_opportunities, benefits, learning_tracks, lessons, forum_questions, forum_answers, rooms, room_members, messages, notifications, achievements, achievement_reactions, testimonials, post_reports, user_blocks, user_mutes, referrals, tags
- Invite-only authentication via magic link: emails outside the invites table are blocked. First admin created via SQL seed. Invites sent via /admin/invites
- Realtime via Supabase for messages and chat rooms, with supabase_realtime publication enabled on messages and rooms tables
- Supabase Storage for avatars, feed images and event covers, with public buckets and per-user access policies
- 3 AI integrations: Groq (fast inference), Gemini (profile matchmaking) and Cerebras (content assistant) — with rate limiting via Upstash Redis
- Gamification with achievements, achievement_reactions, testimonials and ranking — automatic triggers for reaction_count, comment_count and save_count
- Complete admin area: invites, event management, data import, reminders, member management, metrics, report moderation and partner management
- Route protection middleware, server-side auth checks in dashboard and admin layouts, admin role verification
- Deploy on Cloudflare Workers via @opennextjs/cloudflare with Node.js 22, runtime env vars via Worker secrets, subdomain seeds.expostacker.com.br
Timeline
Como o projeto foi conduzido, do mapeamento ao deploy. How the project was conducted, from mapping to deploy.
Fase 1
Modelagem
- Modeling of 40 tables in 8 functional groups
- RLS enabled on all tables with per-user policies
- Automatic triggers for counters (reactions, comments, saves)
- Over 40 indexes including composite and partial
Fase 2
Desenvolvimento
- 51 routes with Next.js 15 App Router
- Invite-only authentication via magic link
- Realtime for messages and rooms
- 3 AI integrations with rate limiting
Fase 3
Deploy
- Migration from Netlify to Cloudflare Workers
- Configuration of @opennextjs/cloudflare
- GitHub Actions with Node 22 for build and deploy
- Subdomain seeds.expostacker.com.br configured
Methodology
Como o projeto foi conduzido, do mapeamento ao deploy. How the project was conducted, from mapping to deploy.
Model the relational database with RLS before coding routes
Use Supabase as complete backend (Auth + DB + Storage + Realtime)
Enable RLS on all tables with per-user policies
Create automatic triggers for counters (reactions, comments, saves)
Protect routes with middleware + admin role verification
Migrate from Netlify to Cloudflare Workers via @opennextjs/cloudflare
Architecture
- → Next.js 15 App Router runs on Cloudflare Workers via @opennextjs/cloudflare
- → Supabase cloud provides PostgreSQL, Auth, Storage and Realtime
- → Middleware protects /app/* and /admin/* routes with session verification
- → Server Components make direct queries to Supabase with RLS
- → Client Components use Realtime subscriptions for messages
- → API routes integrate Groq, Gemini and Cerebras with rate limiting via Upstash Redis
- → Automatic deploy: git push → GitHub Actions → opennextjs-cloudflare build → wrangler deploy
Conceptual diagram — does not reflect real implementation
Tech stack
Technical choices and what was left out.
saas
Why: App Router with Server Components and API routes. 51 routes with dynamic rendering.
Rejected alternative: Pages Router — no Server Components, less DX
Why: Server Components by default, updated hooks and streaming.
Rejected alternative: React 18 — no native Server Components
Why: Design system with accessible components and CSS variables.
Rejected alternative: Styled Components — runtime overhead and no native SSR
saas
Why: PostgreSQL + Auth + Storage + Realtime in one service. RLS at the database.
Rejected alternative: Firebase — no complete SQL, no RLS
Why: 40 tables with Row Level Security and per-user policies.
Rejected alternative: MongoDB — no ACID transactions, no RLS
Why: Typed ORM with TypeScript for server-side queries.
Rejected alternative: Prisma — heavier, less edge-compatible
saas
Why: Full-stack hosting with zero cost, global edge, automatic deploy.
Rejected alternative: Netlify — limited free plan, no global edge
Why: Adapter that converts Next.js App Router to Workers.
Rejected alternative: Vercel — excellent, but higher cost at scale
Why: 3 free AI APIs for matchmaking and assistant.
Rejected alternative: OpenAI — cost per token, less suitable for free tier
Why: Serverless rate limiting for AI endpoints.
Rejected alternative: In-memory rate limiting — doesn't work on edge serverless
Decision log
What I chose, what I rejected, and why.
Supabase as complete backend instead of separate stack
Why: Supabase unifies PostgreSQL, Auth, Storage and Realtime in one service. RLS at the database guarantees row-level security without needing authorization middleware. Native realtime for chat without custom WebSocket. Integrated storage for images. All with a single SDK.
Rejected alternatives: We evaluated Firebase + Firestore, but the lack of complete SQL and RLS was limiting. We also evaluated Node.js + Prisma + self-hosted PostgreSQL, but the infrastructure cost and operational complexity were not justified.
Cloudflare Workers via OpenNext instead of Netlify
Why: Cloudflare Workers offers zero infrastructure cost on the Free plan, automatic deploy via GitHub Actions, global edge network and compatibility with Next.js App Router via @opennextjs/cloudflare. The subdomain seeds.expostacker.com.br stays in the same DNS ecosystem as the other projects.
Rejected alternatives: The project was originally on Netlify. Migrating to Cloudflare Workers unified the deploy ecosystem with the other portfolio projects, eliminated cost and kept the same Supabase cloud as backend — without migrating the database.
RLS on all 40 tables instead of authorization middleware
Why: Row Level Security in PostgreSQL guarantees that each user only accesses their own data and public data. Even if there is a middleware breach, the database blocks access. Per-user policies with auth.uid() are declarative and auditable.
Rejected alternatives: Authorization only in middleware would be faster to implement, but would create a single point of failure. RLS at the database is defense in depth — security in multiple layers.
Community engagement mechanics
Achievements
Achievement system with reactions and categories
Wall
Public achievement wall for social recognition
Ranking
Member ranking by engagement and contributions
Testimonials
Member testimonials with public display
Connections
Networking system between verified entrepreneurs
Groups
Interest groups with membership and dedicated chat
Referrals
Referral program with unique code
Tracks
Learning tracks with progressive lessons
Security and access
Security
-
Row Level Security on all 40 tables in the public schema
-
Invite-only authentication via magic link (emails outside the invites table are blocked)
-
Service role key never exposed client-side, only in Server Components and API routes
-
Route protection middleware with Supabase session verification
-
Admin role verification on all /admin/* routes
-
Rate limiting via Upstash Redis for AI endpoints
-
Runtime secrets configured in the Worker (not just in GitHub)
Lessons learned
Not everything went as planned.
— The biggest lesson was that Supabase + Cloudflare Workers is a powerful combination for full-stack applications with zero infrastructure cost. Migrating from Netlify to Workers via @opennextjs/cloudflare kept the database intact — only the hosting layer changed. RLS on all 40 tables proved that database-level security is more robust than middleware. And the fact that env vars need to be in two places (GitHub Secrets for build + Worker secrets for runtime) was an important lesson: without the secret in the Worker, the app breaks at runtime even with a perfect build.
See also other products
StackPost StackPost — API Unificada de Redes Sociais
API unificada de redes sociais multi-tenant com 19 integrações, 114 endpoints REST, OAuth centralizado, agendamento, analytics e comentários.
View case →
VulnStrike VulnStrike
Scanner de vulnerabilidades SaaS: digite um domínio e receba nota de segurança A+–F com achados explicados e correção passo a passo — scan grátis sem cadastro.
View case →
Nexus IA Nexus IA — Plataforma de IA
Plataforma de IA com 620+ endpoints REST, Nexus Auto com roteamento automático entre 20+ modelos, workspace com agente autônomo, multimodal e 6 planos comerciais.
View case →Want a product like this?
I can do the same for your business. Let's talk.