CLAUDE.md Template: Next.js HR Management SaaS with Supabase, Clerk, Stripe

Overview

A CLAUDE.md template for building an HR Management SaaS with Next.js, TypeScript, Supabase, Clerk, Stripe, AI CV screening, employee records, and onboarding workflows. This page is a copyable CLAUDE.md template you can paste into a CLAUDE.md file to standardize your stack code and practice across teams. Claude Code will interpret this stack and generate coherent, secure, and production ready instructions for your project.

When to Use This CLAUDE.md Template

• you are implementing an HR SaaS using Next.js and TypeScript
• you require Supabase as the database and Clerk for authentication
• you need Stripe for subscriptions and payments
• you plan to integrate AI CV screening for applicant screening
• you need robust onboarding workflows and employee records management

Copyable CLAUDE.md Template

# CLAUDE.md

Project role: You are a Platform Architect building a complete HR Management SaaS using Next.js, TypeScript, Supabase, Clerk, Stripe, AI CV screening, and onboarding workflows. Your output is a Claude Code block that developers can paste directly into CLAUDE.md.

Architecture rules:
- Multi tenancy by organization using Supabase Row Level Security
- Next.js app with the App Router for UI and server components
- Clerk for authentication and role based access control
- Stripe for customer subscriptions and invoicing
- AI CV screening microservice integrated via a server side API route
- All business logic executed on server side or via API routes
- Data validation performed on server side with strict types

File structure rules:
- Use a clear, stack aligned layout
- Separate concerns into apps, services, and db folders
- Do not include irrelevant folders or technologies
- Provide a minimal yet complete starter skeleton for deployment

Authentication rules:
- Clerk handles sign in out and session management
- Roles: admin, hr, manager, employee
- Protected endpoints enforce role based access and org scope
- Do not expose API keys or secrets to the client

Database rules:
- Supabase with Row Level Security enabled
- Tenant data separated by organization_id
- Tables: organizations, users, employees, onboarding_tasks, cvs, candidates, subscriptions
- Enforce foreign key relationships and constraints
- Sensitive fields encrypted at rest where supported by the provider

Validation rules:
- Validate email, dates, identifiers on every API boundary
- Use strict TypeScript types and input validation via a schema library
- Normalize text fields to avoid inconsistent data

Security rules:
- Never ship secrets to the client
- CSRF protection for write forms
- Input sanitization to prevent XSS and SQL injection
- Maintain audit logs for HR changes and on onboarding

Testing rules:
- Unit tests for utilities and hooks
- Integration tests for API routes and data layer
- End to end tests for onboarding and employee lifecycle flows
- Use CI to run tests on PRs

Deployment rules:
- Deploy on Vercel or similar hosting for Next.js apps
- Environment variables: SUPABASE_URL, SUPABASE_ANON_KEY, CLERK_FRONTEND_API, CLERK_API_KEY, STRIPE_SECRET_KEY, AI_VC_SERVICE_URL, AI_VC_API_KEY
- Ensure proper production settings and remote logging

Things Claude must not do:
- Do not bypass Clerk auth or ignore org scoping
- Do not hardcode secrets or API keys in code
- Do not rely on client side validation for security critical paths
- Do not implement client side Stripe flows without server side verification
- Do not reveal private keys in logs or outputs

Recommended Project Structure

apps/web
├─ app
│  ├─ layout.tsx
│  └─ page.tsx
├─ components
├─ hooks
│  └─ useAuth.ts
├─ lib
│  ├─ supabaseClient.ts
│  └─ clerkClient.ts
├─ services
│  ├─ aiCvService.ts
│  └─ stripeService.ts
└─ styles

db
├─ schema.sql
└─ migrations

README.md
.env.example

Core Engineering Principles

• Code Construction Rules

  • Security and Production Rules

    • Testing Checklist

      • Common Mistakes to Avoid

        • Related implementation resources: AI Use Case for Software Agencies Using Github Copilot To Accelerate Boilerplate Code Generation for New Client Mvps and Designing production-grade log filters to mask customer data and secrets in trace files.

          FAQ

          What is included in this CLAUDE.md Template

          A copyable CLAUDE.md block plus stack specific rules for Next.js TS, Supabase, Clerk, Stripe, and AI CV screening

          Which stack is covered

          Next.js with TypeScript, Supabase for database, Clerk for auth, Stripe for payments, and AI CV screening integration

          How do I start using this template

          Copy the CLAUDE.md block into your project and adapt the file paths to your repo structure

          How is security handled

          Data is isolated by organization, Clerk manages auth, and Supabase RLS enforces tenant boundaries

          Can I customize the AI CV screening integration

          Yes, replace the AI service in the aiCvService and update endpoints accordingly