2026 · SHIPPED · BUILD

Bazario

The database decides what you may see. The frontend only decides what to draw.

Next.js
TypeScript
Supabase
PostgreSQL
Row-Level Security
PWA

Bazario is a production-grade multi-vendor marketplace built on Next.js and Supabase. Customers browse a shared catalogue and buy from several independent shops in a single checkout; vendors get a storefront, product management, stock control and analytics; administrators run the platform with granular, individually-grantable permissions.

The distinguishing property of the codebase is where the security lives: row-level security policies, column grants and SECURITY DEFINER functions in PostgreSQL, not checks in the React application.

Problem

In most multi-vendor marketplaces, authorization lives in the React application. That means the security model is only as good as the last developer who remembered to check a role before rendering a component — and it collapses entirely the moment someone calls the API directly.

Question

What happens to a marketplace if you move every authorization decision into PostgreSQL and let the frontend keep none of it?

Approach

Enforce authorization with row-level security policies, column grants and SECURITY DEFINER functions. The React app decides what to render; the database decides what you may see and do. Bypassing the UI entirely and calling the API with a stolen anon key gets you nothing extra.

System

Open any stage to see what it does.

CUSTOMER — Browses a shared catalogue and buys from several independent shops in a single checkout.

VENDOR — Own storefront, product management, stock control and analytics — scoped by policy, not by routing.

ADMIN — Platform operation through granular, individually-grantable permissions rather than a single super-user flag.

NEXT.JS APP — Renders. Holds no authorization authority. Installable as a PWA.

ROW-LEVEL SECURITY — Policies, column grants and SECURITY DEFINER functions in PostgreSQL. This is where the security actually lives.

DATA — A single catalogue spanning independent shops, with per-shop stock and order state.

Demo

A working multi-vendor marketplace: shared catalogue, multi-shop single checkout, vendor storefronts with stock and analytics, and an admin surface with granular permissions. Installable as a PWA.

Result

Authorization is enforced in PostgreSQL, so calling the API directly with the anon key grants no additional access beyond what policy allows.
Customers can buy from several independent shops in one checkout.
Ships machine-readable commerce metadata and PWA installability.

Lesson

Writing policies is slower and much less satisfying than writing route guards, and it is the only version of this that I would be willing to have tested by someone hostile. Security you can demonstrate by attacking your own API is worth the tedium.

Source

Bazario — repository ↗

Connected

TeleFlow — Both are WEB and SECURITY and SYSTEMS work, and both are built with Next.js, TypeScript, PostgreSQL.
GUB Portal — Both are WEB and SYSTEMS work, and both are built with Next.js, TypeScript, PWA.
hdgame.me — Both are WEB and SYSTEMS work, and both are built with Next.js, TypeScript.
ContextGuard — Connected through SECURITY and SYSTEMS.