Choosing a tech stack for your first product: a CTO's method

For a first product, pick widely used technologies that other developers can take over, and keep the code and every account in your company's name. In most cases that means Next.js for a web app or SaaS, Flutter for a mobile app, and Supabase or Firebase for data and user accounts. A no-code tool or an AI app builder is enough while you are testing the idea, as long as you have no paying customers and no sensitive data.

The rest of this guide covers the criteria for deciding, then typical choices by type of product.

What is a stack, exactly?

Your "stack" is the set of technologies that run your product. Five building blocks are enough to describe it:

• the interface: what users see, in the browser or on their phone;
• the server logic: business rules, permissions and calculations, everything that must not be changeable from the browser;
• the database and authentication: your customers' data and their accounts;
• external services: payments, email, AI, maps;
• hosting: where all of this runs, and who gets the bill.

The building blocks of a typical web app

1. InterfacePages and screens, with Next.js.
2. Server logicPermissions and business rules, in the same project.
3. Data and accountsPostgreSQL database and sign-in, with Supabase.
4. PaymentsSubscriptions and checkout, with Stripe.
5. HostingDeployment, for example on Vercel.

Six criteria that matter for a first product

1. Web, mobile or both

A web app is enough if your customers use it from a computer, or if your pages need to be found on Google. An app published on the App Store and Google Play makes sense when users need the camera, notifications, offline use or an icon on their home screen. For a first mobile version, a single codebase for iOS and Android, with Flutter or React Native, saves you paying for two builds.

2. Who can take over the code

Your first developer will not be your last. Favour technologies many developers know, such as JavaScript and TypeScript (React, Next.js) or Flutter, over a rare technology chosen because a contractor likes it. Ask plainly: if this contractor disappears tomorrow, who can pick up the code, and how quickly?

3. Ownership and exit

The code should live in a GitHub repository owned by your company, and every account (hosting, database, payments, app stores, domain name) should be in your name. With a no-code tool or an app builder, check what you can take with you:

• Bubble does not export code, and its documentation says an app cannot leave Bubble's hosting; the data itself can be exported as CSV or JSON (hosting, data export);
• Lovable syncs the code with a GitHub repository, both ways (Lovable docs);
• FlutterFlow lets you download the Flutter code on its paid plans (FlutterFlow docs).

4. The shape of your data

If your data is relational (customers, orders, invoices) and you will want reports, a SQL database such as PostgreSQL, which Supabase provides, is the easiest to evolve. If your data is simple and very "real-time", or your mobile app benefits from Google's services (notifications, crash reporting), Firebase is a strong candidate.

5. What it costs to run

Free plans are fine for testing, but their limits matter as soon as real customers arrive:

• Vercel's free Hobby plan is restricted to personal, non-commercial use (Vercel);
• on Supabase's free plan, a project is paused after one week of inactivity, and automatic backups are not included (Supabase);
• Firebase offers a free plan (Spark) and a pay-as-you-go plan (Blaze) (Firebase).

Ask your developer for an estimate of the monthly running cost today, and with ten times more users.

6. Security and updates

Every stack needs updates, and someone has to apply them. A recent example: in December 2025, a critical flaw rated 10 out of 10 (CVSS 10.0) hit React Server Components and the Next.js 15 and 16 apps using the App Router. The only fix was to upgrade, and Next.js advised rotating the secrets of any app left online unpatched (Next.js security advisory). Since July 2026, Next.js has published security releases roughly once a month, announced in advance (Next.js). Budget for that time.

Typical choices by type of product

Starting points by type of product

Your product	Interface	Data and accounts	Watch out for
B2B SaaS or business tool	Next.js	Supabase (PostgreSQL)	Per-customer permissions, checked by the server
Consumer mobile app	Flutter	Firebase or Supabase	App store rules, subscriptions
Public website with customer area	Next.js	Supabase	Search visibility of public pages
Internal tool, few users	No-code or AI app builder	The tool's own	Data export, staff leaving

Next.js or plain React?

React is a library created by Meta for building interfaces. Next.js is a framework built on React: it adds server-rendered pages, routing and server code, all in one project.

• Choose Next.js when your public pages must be indexed by Google and show a preview when shared, or when you want the interface and the server logic in one project, run by one developer.
• Plain React, for example with the Vite tool, is enough for an app that sits entirely behind a login, with an API built separately.

Mixing interface and server code takes discipline. The Next.js documentation points out that a Server Action, the server function behind a form, can still be called by a direct request, so each one must check who is calling and what they are allowed to do. Any variable whose name starts with NEXT_PUBLIC_ is sent to the browser, so it must never hold a secret key (Next.js data security). The current major version is Next.js 16, released in October 2025 (Next.js 16). That number will soon change; what matters is that your team can keep up with updates.

Flutter or React Native for mobile?

Both build an iOS and Android app from a single codebase. Flutter, created by Google and written in Dart, draws the whole interface itself, so it looks the same on every phone. React Native, created by Meta, uses the phone's own components and JavaScript, which makes it the natural choice if your team already writes React. My detailed comparison is in French on the site.

Supabase or Firebase?

Both provide a database, authentication, file storage and server functions. Supabase is built on PostgreSQL, so SQL makes reporting easier, and the project is open source. Firebase, from Google, relies mostly on Firestore, a document database, with a very complete mobile ecosystem. Either way, the number one risk is the same: access rules left too open. The detailed comparison is in French on the site.

When no-code or an AI app builder is enough

AI app builders (Lovable, Bolt, v0, Replit) and no-code tools (Bubble, FlutterFlow) let you test an idea in days. Two questions decide whether they are enough: what you stand to lose if the data leaks, and how long the product has to last.

A few monthsExpected lifespanSeveral years

No-code or AI app builderAI app builder, reviewed before launchDurable no-code, or a tool that exports codeCode on a widely used stackPrototype for investorsFirst customers on a trialInternal team toolConsumer mobile appSubscription SaaS

Test dataData at stakePaying customers, personal data

The time to move to code comes with the first paying customers, personal data, an app to publish on the stores, or questions from an investor. How much that move costs depends on where you started: a Lovable or FlutterFlow project is taken over from its code, while a Bubble app is rebuilt, keeping its data.

Mistakes that get expensive later

• Accounts in the contractor's name. Host, database, Stripe or app stores: without owner access, you cannot change anything without them.
• Copying a big company's architecture. Microservices on Kubernetes need a team to run them. For a first version, one well-organised project is easier to maintain.
• A rare technology chosen out of taste. It shrinks the pool of people who can take over the code.
• Going live on a free plan. Pausing, missing backups or a ban on commercial use: those limits bite at the worst moment.
• No budget for updates. Next.js, for one, ships security patches roughly once a month, and someone has to apply them.

My take as a CTO

I mostly build with Flutter and Next.js, so I am not neutral. Here are the stacks of my own projects, as published in my case studies:

The stacks behind my projects

Project	Product	Stack
BabyCheck	iOS and Android app, launched in 14 days	Flutter, Firebase, RevenueCat
MonJoliMariage	Web SaaS with AI	Next.js
Jo's Burger	Customer app and back office	Flutter, Node.js
Welco	Platform and app, 150,000+ registered users	Flutter, React, Angular, Node.js, Kubernetes, MongoDB

BabyCheck confirmed to me that a standard stack does not slow you down: Flutter, Firebase and RevenueCat, and the app was live in 14 days. Welco's microservices architecture was there to absorb strong growth in load, with a full team of developers, designers, DevOps and QA. For a first version run by one or two developers, I do not recommend it. I start with a single Next.js or Flutter project, a Supabase or Firebase backend, and accounts in the client's name from day one.

FAQ

Should I choose the stack before hiring a developer?

Set the criteria first: web or mobile, the kind of data, the running budget, who will take over the code. Then let the developer propose the tools, and ask them to justify any uncommon choice.

Can I start with no-code and move to code later?

Yes, and it is often the right approach. The cost of the move depends on the tool: FlutterFlow or Lovable code can be taken over, while a Bubble app is rebuilt with its data.

Is Next.js suitable for a mobile app?

Next.js builds web apps. For an app published on the App Store and Google Play, you need a real mobile app, built for example with Flutter or React Native. Your website and back office can stay on Next.js.

How long does a first version take?

It depends on scope. BabyCheck launched in 14 days; a first SaaS version usually takes a few weeks. The timeline is set during scoping, before work starts.

Next step

• Free resource: before going live, run your project through the production-readiness checklist (in French): data, secrets, backups, costs.
• Launch your product: the product development offer covers scoping, design, development and launch, with the code and accounts in your name, from €5,000 excl. VAT.
• Already have an app built with an AI app builder? The technical diagnostic tells you what to keep, fix or rebuild.

Torn between two options? Book a 15-minute call.

Sources

• Next.js, Security Advisory: CVE-2025-66478, Next.js Security Release and Our Next Patch Release, Next.js 16, How to think about data security in Next.js
• React, Critical Security Vulnerability in React Server Components
• Vercel, Hobby Plan
• Supabase, Pricing
• Firebase, Pricing
• Bubble, How Bubble hosting works, Exporting data
• Lovable, Sync your Lovable project with GitHub
• FlutterFlow, Plan Comparison
• Flutter, official website