How to build a startup directory website with Replit

Rule of thumb: if you want a directory this week and do not care whose software it runs on, rent one. Brilliant Directories or eDirectory will have you live before this guide is finished. If the directory is the product, or the thing that brings people to your newsletter, your fund or your community, the shelf is worth owning, because the meters above are exactly where a growing directory pays and a curated list of companies with their rounds is an asset you should be able to move, export and redesign at will. The honest middle case is a directory whose value is somebody else’s data. There the answer is a subscription, because you may read Dealroom’s rounds and you may not republish them.

* On this template the free-tier lines to watch are images and the pause. The free plan includes 1 GB of file storage, and a cover or gallery image may be up to 10 MB, so a directory with a few hundred companies and their pictures reaches it. It also pauses a project after a week without activity, and a directory nobody edits for a week is normal. Pro, from $25/mo, lifts storage to 100 GB, ends the pause and keeps a daily backup for 7 days, with spend caps on by default.

Prices and rates from supabase.com, developex.com and replit.com, checked September 2026.

The first two are all you need to start. Everything here stays inside the one browser tab, the app included once you publish it, and the GitHub copy is the one deliberate exception.

1. 01

   Start the app, ask for the database, and set the rules

   The database comes free with the workspace, so it goes in the opening message. So do the two rules that matter most on this build.

   PromptSet up the project and the databaseCopy

   Set up a React 18 + Vite + TypeScript app with Tailwind, and add a Postgres database to this Repl, the one Replit provisions, not anything outside. Write a short notes file at the project root saying this is a startup directory with news and a funding tracker, fixing the vocabulary as startups, funding rounds, categories, tags, articles and admins, and recording two standing rules: nothing is public until its status is published and the database enforces that rather than the screen, and only an admin may add, change or delete anything. Keep the database connection details in Secrets rather than in the code.

   The rules are worth writing into the notes file rather than a single message. Filtering drafts in the screen is a natural suggestion for any assistant, and it would show every draft to anyone who asked the server directly.

2. 02

   Write the tables, the trigger and the publish rule, then test it as a stranger

   Ten tables, a trigger that keeps the funding totals right, and the half of the access rules that decides what the public sees. Roll back to a checkpoint if the schema goes sideways rather than unpicking it.

   PromptWrite the data model and the public rulesCopy

   Write the tables for this site and show me the SQL before running it. Categories and tags with a name and slug. Startups with name, slug, short and long descriptions, a category, a funding stage from a fixed list (Seed, Series A through Series E+, IPO, Grant, Acquisition), a published or unpublished status defaulting to unpublished, an archived flag, logo and cover addresses, a gallery, team size, city and country, links, and total and latest funding columns. A startup_tags join table and a social links table. Funding rounds with stage, amount, date, lead investor, co-investors, valuations and notes, and a trigger that recalculates the startup’s total and latest raise on every change. Articles with title, slug, body, featured image, category, author, status and published date, and a news_tags join table. Turn on row-level security on every table and write the public half of the rules for a request with no session: anyone may read categories and tags, a published and unarchived startup with its rounds and links, and a published article. Seed three companies with a round each, one unpublished, and show me that a request with no session returns two.

   The request with no session is the test that matters. If it returns three, the publish rule lives in the screen rather than the database, and everything after this step inherits the leak.

3. 03

   Add sign-in, roles and the admin gate, and tell the database who is asking

   Replit’s Postgres is a plain database with no login wired into it, so the Agent writes both halves: sessions on the server, and policies the server’s identity feeds.

   PromptAdd sign-in, roles and the admin rulesCopy

   Add email-and-password sign-in with logout and a server-side session, and no public sign-up screen. Add a user_roles table with admin and viewer roles, and give every new account a profile row and the viewer role. Have the server set the current user and role as a session-local setting at the start of each request, and write the admin half of every access rule against that setting so an admin may read, add, change and delete every row in every table, drafts included. Build an admin layout that sends anyone without the admin role back to sign-in. Tell me how to promote my own account to admin, and show me that a viewer sees exactly what a request with no session sees.

   There is no ready-made login handing the database a user id here, so the server is what knows who is asking. Build that first and the policies have something to read.

4. 04

   Build the directory, the company view and the funding page

   The public side. Check the preview after each change here rather than stacking several and finding out which one broke a filter.

   PromptBuild the directory and the funding pageCopy

   Build the public directory page: a grid of company cards with the logo, name, one-line description, category, stage and total raised, a filter sidebar with search over name and description, categories, funding stages, a minimum and maximum amount raised and a location field, a sort menu (newest, oldest, most funded, least funded, A to Z) and a live result count with a clear-all button. A card opens a detail view with the full description, links and the rounds in date order, at an address of its own so a link can be shared. Then build the funding page: every round with its company, stage, amount, date and investors, filterable by stage and by amount, sorted by amount. Every route reads through the server, and only published, unarchived companies come back.

   This is the step where checkpoints earn their keep. A filter that worked two messages ago and does not now is a one-click problem rather than an afternoon.

5. 05

   Build the news section, the admin and the uploads

   Articles with a page each, then the back office with one screen per table, and image uploads that the server checks and stores, because this database has no bucket service attached.

   PromptBuild the news section and the adminCopy

   Build the news section: a list of published articles with the featured image, title, category and date, and a page per article at /news/its-slug showing the featured image and the body with its line breaks kept. Then the admin behind the admin layout: a dashboard with counts of startups, articles and accounts, a startups screen with add and edit dialogs, add a funding round, publish or unpublish, archive, and delete a company together with its rounds, links and tags, then screens for articles, categories, tags, and users where a role is switched between admin and viewer. Add upload routes for logos, covers, gallery and article images that check the caller is a signed-in admin and the file is an image under 5 MB for a logo and 10 MB otherwise, store it where the server controls, and write its address to the record. Serve the images from the server.

   Read the delete. A company that leaves the directory must take its rounds, tags and links with it, or the funding page shows rounds for a company that no longer exists.

6. 06
   Destination

   Add the landing page and the meta, then publish

   Finish with the marketing page and the share cards, look at the site as a stranger, then publish, checking who the site is visible to before that first release, since Publishing is what sets it.

   PromptAdd the landing page, demo mode, and publishCopy

   Add a marketing landing page with a hero, a sector section, a funding section, a trends section and a closing call to action, written as copy I can edit rather than pulled from the database. Give every public page a title and description and the card that shows when the link is shared. Add a demo mode switch on the sign-in screen that opens the admin with every write intercepted in the browser and a banner saying changes are not saved. Then help me test the whole site signed out: confirm the unpublished company is nowhere, confirm an article address opens directly, confirm the admin sends me to sign-in. When it holds up, walk me through Publishing: which deployment type fits a site read by the public and edited by a few admins, and who it should be visible to.

Review the access rules (row-level security policies) on every table. For each one, tell me in simple terms who can view, add, edit, and delete records, confirm that people can only reach their own data while the right roles can reach more, and flag anything left open that shouldn’t be.

One rule outranks everything above it: the database connection details belong in Secrets only: never in anything the browser downloads, and never in a repository. If they get out, treat them as compromised and rotate them the same day.

All four are Replit rather than a third party, so the choice is shape rather than vendor, and Autoscale suits most of these sites. Two things specific to this build: the server is small, because visitors mostly read, and the images are served by that server rather than a bucket, so a directory with many large covers is the one case where a Reserved VM earns its price. Review who the site is visible to before that first release.

Add a server-side function called ai that calls my AI provider with the key held in function secrets, never in the browser. It accepts a task name and the text or fields for that task, refuses any caller who is not a signed-in admin, records every call in an ai_calls table (who, which task, tokens in and out, a cost estimate, success or failure), and returns the model’s answer as structured fields the admin screens can fill in. Add a small usage panel to the admin dashboard showing calls and estimated spend this month.

In the add-startup dialog, add a “Draft from website” button that sends the company’s homepage text to the ai function and gets back a one-line and a paragraph description, a suggested category from my categories table, up to five tags, the city and country, and any social links it found. Fill the form with the results for the admin to edit, and never publish anything automatically.

Add a “From announcement” action on the news screen that sends pasted text to the ai function and gets back a draft article (title, slug, body) and, if the text describes a raise, a funding round (stage from my stage list, amount, date, lead investor, co-investors). Show both as prefilled forms for the admin to confirm, match the article to a startup by name with a confirmation step, and leave both unpublished until the admin publishes them.

When an admin saves a startup or an article without tags, call the ai function with the description and get back a suggested category from my table and up to five tags, preferring tags that already exist. Show them as chips the admin accepts or removes before saving, and add a “Suggest tags” button on existing records so the back catalogue can be tidied a page at a time.

Add a “Weekly digest” button on the admin dashboard that gathers the startups, rounds and articles published in the last seven days and asks the ai function for a short digest with a headline, one paragraph, and a bullet per raise with the amount and stage. Save it as an unpublished article and offer a copy-as-text button, since this site does not send email.

A cheap model is plenty for most of the prompts above. Save Pro’s stronger models for the one or two spots where the extra reasoning actually pays for itself. Add any provider key through Replit’s own Secrets tool rather than hard-coding it, and keep every AI feature behind one server-side function so a single key covers the whole app.