Your AI agent writes the code.
Our rules make it write it right.
RulesDrop packs are tested bundles of Cursor rules, AGENTS.md, CLAUDE.md and step-by-step prompts for one stack at a time. Less re-prompting, no leaked keys, no tables without Row Level Security.
See Pack #1, Next.js + Supabase SaaS ($19)Tested, not vibes
Every pack is build-tested on a fresh project before it ships.
Security built in
RLS policies, server-only secrets, and signed Stripe webhooks are rules your agent follows by default.
Works in every agent
Cursor, Claude Code, Codex, Windsurf and Copilot are all covered with one pack.
FAQ
What is a Cursor rules pack?
A bundle of project rule files (.cursor/rules/*.mdc), AGENTS.md and CLAUDE.md, plus a prompt playbook and reference code, that tells an AI coding agent how to build a specific stack correctly and securely.
Does it work with Claude Code, Codex or Windsurf, not just Cursor?
Yes. Cursor reads .cursor/rules, Claude Code reads CLAUDE.md (which imports AGENTS.md), and Codex, Copilot, Jules and Windsurf read AGENTS.md.
Which versions is Pack #1 tested on?
Next.js 15.5, React 19, @supabase/ssr 0.12, supabase-js 2, Stripe Node SDK 23 and zod 4. The reference templates pass npm run build on a fresh create-next-app project. Node.js 22+ is recommended.
Will this make my app secure?
It removes the most common vibe-coding mistakes (missing Row Level Security, service-role keys in the browser, unverified Stripe webhooks, open redirects) and gives you a checklist, but you are still responsible for reviewing and testing your own app.
How much does it cost?
Pack #1 is $19 one-time with free updates for the Next.js 15 line.
Can I get a refund?
Yes. If the pack doesn't help, email us within 14 days for a refund.
Is the newsletter free?
Yes. Vibe Coded This Week is free and comes out weekly. Every app we feature links to a public source.
I unzipped the pack but can't find .cursor — and what is the project root?
Your project root is the top folder you open in Cursor, where package.json lives. The .cursor folder is hidden because its name starts with a dot: on Mac press Cmd+Shift+. in Finder; on Windows use File Explorer → View → Show → Hidden items. Easiest install: open your project in Cursor and drag .cursor, AGENTS.md and CLAUDE.md from the unzipped pack into the sidebar. Or from the project root run: Mac/Linux `cp -R /path/to/pack/.cursor . && cp /path/to/pack/AGENTS.md /path/to/pack/CLAUDE.md .` ; Windows PowerShell `Copy-Item -Recurse \path\to\pack\.cursor .` then copy the two markdown files. Confirm in Cursor Settings → Rules. No project yet? Start with step 0 (Scaffold) in PROMPTS.md.
Is the .cursor folder the Cursor app?
No. The .cursor folder in the pack is just settings files (rules). You still need to download and install the Cursor app from https://cursor.com, open it, and sign in. Then use File → Open Folder on the unzipped pack (or your project).
I installed Node but don't see it in Applications — did it work?
Yes, that is normal. Node.js has no app icon. Open Cursor's chat (Cmd+L on Mac, Ctrl+L on Windows) and ask it to run `node -v`. You should see v22.x.x or newer. If not, reinstall the LTS macOS/Windows installer from https://nodejs.org/en/download and restart Cursor.
Where do I paste the PROMPTS.md steps?
Paste them one at a time into Cursor's chat box inside the Cursor app (Cmd+L / Ctrl+L) — not into TextEdit, Notes, or another chat. Open the unzipped pack with File → Open Folder first. When Cursor asks permission to run a command, click Allow / Run.
`npx supabase db push` fails. How do I apply the database migration?
db push needs a linked project (npx supabase login, then npx supabase link --project-ref ). The simpler way: in the Supabase dashboard open SQL Editor → New query, paste all of supabase/migrations/0001_init.sql, and click Run, then do the same with 0002_security_guards.sql. Then run npm run rls-test with two test users to confirm the policies work.
My production build is broken but npm run dev works. Why?
Check package.json: if the build script is "next build --turbopack", change it to plain "next build". The Turbopack production build produced a broken app in our testing. Keep --turbopack on dev only.
Has the starter code been security-reviewed?
Yes. In v1.2 the full app built from the pack went through a security review, and every fix is in the templates and rules: plan and billing columns locked in the database, free-plan limits enforced in the database, Pro granted only for an active Stripe subscription with duplicate webhooks ignored, stricter open-redirect checks (including URL-encoded tricks), Origin checks on checkout and billing, a nonce Content-Security-Policy, security headers and httpOnly cookies. One thing to do yourself: the included login rate limiter is in-memory, so swap it for your host's firewall or a shared store before launch.