# RulesDrop

> RulesDrop sells build-tested rules packs for AI coding agents (Cursor, Claude Code, Codex, Windsurf, Copilot). Each pack has Cursor .mdc project rules, AGENTS.md, CLAUDE.md, a step-by-step prompt playbook, a security checklist and reference code for one stack. It also publishes the free weekly newsletter "Vibe Coded This Week".

## Products
- [Pack #1: Next.js + Supabase SaaS Starter](https://rulesdrop.com/packs/nextjs-supabase-saas-starter/): $19 one-time. Next.js 15 App Router, React 19, @supabase/ssr, Stripe Checkout + signed webhooks, zod. Templates pass `npm run build` and `npm run lint` on a fresh create-next-app project.

## Guides
- [Supabase RLS for vibe coders: the 8 rules your AI agent keeps breaking](https://rulesdrop.com/blog/supabase-rls-checklist-for-vibe-coders/): How to make Cursor or Claude Code write correct Supabase Row Level Security policies, with copy-paste SQL and a test you can run.
- [Cursor rules vs AGENTS.md vs CLAUDE.md: which file does your AI agent read?](https://rulesdrop.com/blog/cursor-rules-vs-agents-md-vs-claude-md/): A plain-English guide to .cursor/rules (.mdc), AGENTS.md and CLAUDE.md: what each tool reads, how to structure them, and how to keep one source of truth.
- [Stripe webhooks in the Next.js App Router: the 5 mistakes AI agents make](https://rulesdrop.com/blog/stripe-webhooks-nextjs-app-router/): How to verify Stripe webhook signatures in a Next.js 15 route handler, avoid build failures, and grant access safely. Includes working code.

## Newsletter
- [Vibe Coded This Week](https://rulesdrop.com/newsletter/): free weekly roundup of AI-built apps, every claim sourced.
- [Subscribe free (Beehiiv)](https://johns-newsletter-9d6287.beehiiv.com/subscribe)
- [Issue #1](https://rulesdrop.com/newsletter/issue-1/)

## FAQ
- **What is a Cursor rules pack?** A bundle of project rule files (.cursor/rules/*.mdc), AGENTS.md and CLAUDE.md, plus a prompt playbook and reference code, that tells an AI coding agent how to build a specific stack correctly and securely.
- **Does it work with Claude Code, Codex or Windsurf, not just Cursor?** Yes. Cursor reads .cursor/rules, Claude Code reads CLAUDE.md (which imports AGENTS.md), and Codex, Copilot, Jules and Windsurf read AGENTS.md.
- **Which versions is Pack #1 tested on?** Next.js 15.5, React 19, @supabase/ssr 0.12, supabase-js 2, Stripe Node SDK 23 and zod 4. The reference templates pass npm run build on a fresh create-next-app project. Node.js 22+ is recommended.
- **Will this make my app secure?** It removes the most common vibe-coding mistakes (missing Row Level Security, service-role keys in the browser, unverified Stripe webhooks, open redirects) and gives you a checklist, but you are still responsible for reviewing and testing your own app.
- **How much does it cost?** Pack #1 is $19 one-time with free updates for the Next.js 15 line.
- **Can I get a refund?** Yes. If the pack doesn't help, email us within 14 days for a refund.
- **Is the newsletter free?** Yes. Vibe Coded This Week is free and comes out weekly. Every app we feature links to a public source.
- **I unzipped the pack but can't find .cursor — and what is the project root?** Your project root is the top folder you open in Cursor, where package.json lives. The .cursor folder is hidden because its name starts with a dot: on Mac press Cmd+Shift+. in Finder; on Windows use File Explorer → View → Show → Hidden items. Easiest install: open your project in Cursor and drag .cursor, AGENTS.md and CLAUDE.md from the unzipped pack into the sidebar. Or from the project root run: Mac/Linux `cp -R /path/to/pack/.cursor . && cp /path/to/pack/AGENTS.md /path/to/pack/CLAUDE.md .` ; Windows PowerShell `Copy-Item -Recurse \path\to\pack\.cursor .` then copy the two markdown files. Confirm in Cursor Settings → Rules. No project yet? Start with step 0 (Scaffold) in PROMPTS.md.
- **Is the .cursor folder the Cursor app?** No. The .cursor folder in the pack is just settings files (rules). You still need to download and install the Cursor app from https://cursor.com, open it, and sign in. Then use File → Open Folder on the unzipped pack (or your project).
- **I installed Node but don't see it in Applications — did it work?** Yes, that is normal. Node.js has no app icon. Open Cursor's chat (Cmd+L on Mac, Ctrl+L on Windows) and ask it to run `node -v`. You should see v22.x.x or newer. If not, reinstall the LTS macOS/Windows installer from https://nodejs.org/en/download and restart Cursor.
- **Where do I paste the PROMPTS.md steps?** Paste them one at a time into Cursor's chat box inside the Cursor app (Cmd+L / Ctrl+L) — not into TextEdit, Notes, or another chat. Open the unzipped pack with File → Open Folder first. When Cursor asks permission to run a command, click Allow / Run.
- **`npx supabase db push` fails. How do I apply the database migration?** db push needs a linked project (npx supabase login, then npx supabase link --project-ref <ref>). The simpler way: in the Supabase dashboard open SQL Editor → New query, paste all of supabase/migrations/0001_init.sql, and click Run, then do the same with 0002_security_guards.sql. Then run npm run rls-test with two test users to confirm the policies work.
- **My production build is broken but npm run dev works. Why?** Check package.json: if the build script is "next build --turbopack", change it to plain "next build". The Turbopack production build produced a broken app in our testing. Keep --turbopack on dev only.
- **Has the starter code been security-reviewed?** Yes. In v1.2 the full app built from the pack went through a security review, and every fix is in the templates and rules: plan and billing columns locked in the database, free-plan limits enforced in the database, Pro granted only for an active Stripe subscription with duplicate webhooks ignored, stricter open-redirect checks (including URL-encoded tricks), Origin checks on checkout and billing, a nonce Content-Security-Policy, security headers and httpOnly cookies. One thing to do yourself: the included login rate limiter is in-memory, so swap it for your host's firewall or a shared store before launch.