Frequently asked questions

A bundle of project rule files (.cursor/rules/*.mdc), AGENTS.md and CLAUDE.md, plus a prompt playbook and reference code, that tells an AI coding agent how to build a specific stack correctly and securely.

Yes. Cursor reads .cursor/rules, Claude Code reads CLAUDE.md (which imports AGENTS.md), and Codex, Copilot, Jules and Windsurf read AGENTS.md.

Next.js 15.5, React 19, @supabase/ssr 0.12, supabase-js 2, Stripe Node SDK 23 and zod 4. The reference templates pass npm run build on a fresh create-next-app project. Node.js 22+ is recommended.

It removes the most common vibe-coding mistakes (missing Row Level Security, service-role keys in the browser, unverified Stripe webhooks, open redirects) and gives you a checklist, but you are still responsible for reviewing and testing your own app.

Pack #1 is $19 one-time with free updates for the Next.js 15 line.

Yes. If the pack doesn't help, email us within 14 days for a refund.

Yes. Vibe Coded This Week is free and comes out weekly. Every app we feature links to a public source.

Your project root is the top folder you open in Cursor, where package.json lives. The .cursor folder is hidden because its name starts with a dot: on Mac press Cmd+Shift+. in Finder; on Windows use File Explorer → View → Show → Hidden items. Easiest install: open your project in Cursor and drag .cursor, AGENTS.md and CLAUDE.md from the unzipped pack into the sidebar. Or from the project root run: Mac/Linux `cp -R /path/to/pack/.cursor . && cp /path/to/pack/AGENTS.md /path/to/pack/CLAUDE.md .` ; Windows PowerShell `Copy-Item -Recurse \path\to\pack\.cursor .` then copy the two markdown files. Confirm in Cursor Settings → Rules. No project yet? Start with step 0 (Scaffold) in PROMPTS.md.

No. The .cursor folder in the pack is just settings files (rules). You still need to download and install the Cursor app from https://cursor.com, open it, and sign in. Then use File → Open Folder on the unzipped pack (or your project).

Yes, that is normal. Node.js has no app icon. Open Cursor's chat (Cmd+L on Mac, Ctrl+L on Windows) and ask it to run `node -v`. You should see v22.x.x or newer. If not, reinstall the LTS macOS/Windows installer from https://nodejs.org/en/download and restart Cursor.

Paste them one at a time into Cursor's chat box inside the Cursor app (Cmd+L / Ctrl+L) — not into TextEdit, Notes, or another chat. Open the unzipped pack with File → Open Folder first. When Cursor asks permission to run a command, click Allow / Run.

db push needs a linked project (npx supabase login, then npx supabase link --project-ref ). The simpler way: in the Supabase dashboard open SQL Editor → New query, paste all of supabase/migrations/0001_init.sql, and click Run, then do the same with 0002_security_guards.sql. Then run npm run rls-test with two test users to confirm the policies work.

Check package.json: if the build script is "next build --turbopack", change it to plain "next build". The Turbopack production build produced a broken app in our testing. Keep --turbopack on dev only.

Yes. In v1.2 the full app built from the pack went through a security review, and every fix is in the templates and rules: plan and billing columns locked in the database, free-plan limits enforced in the database, Pro granted only for an active Stripe subscription with duplicate webhooks ignored, stricter open-redirect checks (including URL-encoded tricks), Origin checks on checkout and billing, a nonce Content-Security-Policy, security headers and httpOnly cookies. One thing to do yourself: the included login rate limiter is in-memory, so swap it for your host's firewall or a shared store before launch.