Your AI agent writes the code.
Our rules make it write it right.

Five Cursor project rules in .cursor/rules (00-core, 10-supabase, 20-auth, 30-stripe, 40-security), an AGENTS.md for Codex, Copilot, Jules and Windsurf, a CLAUDE.md for Claude Code, PROMPTS.md (a 10-step prompt playbook, steps 0 to 9: scaffold, Supabase clients + middleware, auth, database with RLS, verify RLS, dashboard, Stripe, plan gating, pre-deploy audit, deploy to Vercel), SECURITY-CHECKLIST.md, and a templates folder with reference code.

Supabase browser, server and service-role clients; middleware that refreshes sessions and sets a nonce Content-Security-Policy; login and signup pages with Server Actions and zod validation; an auth callback with safe redirects; a dashboard with server actions; Stripe Checkout, a signed and idempotent webhook, and Customer Portal routes; SQL migrations (0001_init.sql and 0002_security_guards.sql) with Row Level Security; next.config.ts security headers; a two-user RLS test script (rls-test.ts) and a redirect test script (check-redirects.mjs); and .env.example.

No. It is rules, prompts and reference code that guide your AI agent while it builds the app in your own project. You paste the playbook steps into Cursor (or Claude Code / Codex) one at a time, and each step ends with npm run build.

Next.js 15 App Router, React 19, TypeScript strict, Tailwind v4, @supabase/ssr and @supabase/supabase-js, Stripe Checkout and Customer Portal for subscriptions, zod for validation, and deployment to Vercel.

Examples: default to Server Components, validate every input with zod, await cookies() and params in Next 15, use supabase.auth.getUser() (never getSession()) on the server, enable RLS on every table in the same migration, keep the service-role key server-only, verify Stripe webhooks with the raw body, grant Pro only for an active subscription, and only redirect to safe relative paths.

Paid packs are paused right now, so there is no checkout. Read the free Cursor rules guide in the meantime.

A bundle of project rule files (.cursor/rules/*.mdc), AGENTS.md and CLAUDE.md, plus a prompt playbook and reference code, that tells an AI coding agent how to build a specific stack correctly and securely.

Yes. Cursor reads .cursor/rules, Claude Code reads CLAUDE.md (which imports AGENTS.md), and Codex, Copilot, Jules and Windsurf read AGENTS.md.

Next.js 15.5, React 19, @supabase/ssr 0.12, supabase-js 2, Stripe Node SDK 23 and zod 4. The reference templates pass npm run build on a fresh create-next-app project. Node.js 22+ is recommended.

It removes the most common vibe-coding mistakes (missing Row Level Security, service-role keys in the browser, unverified Stripe webhooks, open redirects) and gives you a checklist, but you are still responsible for reviewing and testing your own app.

Not right now. Paid packs are paused and will be back later. In the meantime, start with the free Cursor rules for Next.js + Supabase guide at https://rulesdrop.com/guides/cursor-rules-nextjs-supabase/, and get the free newsletter to hear when packs are back.

Paid packs are paused right now. If you bought Pack #1 before the pause, email support@rulesdrop.com. When packs are back, the refund terms are shown on the pack page before checkout.

Yes. Vibe Coded This Week is free and comes out weekly. Every app we feature links to a public source.

Your project root is the top folder you open in Cursor, where package.json lives. The .cursor folder is hidden because its name starts with a dot: on Mac press Cmd+Shift+. in Finder; on Windows use File Explorer → View → Show → Hidden items. Easiest install: open your project in Cursor and drag .cursor, AGENTS.md and CLAUDE.md from the unzipped pack into the sidebar. Or from the project root run: Mac/Linux `cp -R /path/to/pack/.cursor . && cp /path/to/pack/AGENTS.md /path/to/pack/CLAUDE.md .` ; Windows PowerShell `Copy-Item -Recurse \path\to\pack\.cursor .` then copy the two markdown files. Confirm in Cursor Settings → Rules. No project yet? Start with step 0 (Scaffold) in PROMPTS.md.

No. The .cursor folder in the pack is just settings files (rules). You still need to download and install the Cursor app from https://cursor.com, open it, and sign in. Then use File → Open Folder on the unzipped pack (or your project).

Yes, that is normal. Node.js has no app icon. Open Cursor's chat (Cmd+L on Mac, Ctrl+L on Windows) and ask it to run `node -v`. You should see v22.x.x or newer. If not, reinstall the LTS macOS/Windows installer from https://nodejs.org/en/download and restart Cursor.

Paste them one at a time into Cursor's chat box inside the Cursor app (Cmd+L / Ctrl+L) — not into TextEdit, Notes, or another chat. Open the unzipped pack with File → Open Folder first. When Cursor asks permission to run a command, click Allow / Run.

db push needs a linked project (npx supabase login, then npx supabase link --project-ref ). The simpler way: in the Supabase dashboard open SQL Editor → New query, paste all of supabase/migrations/0001_init.sql, and click Run, then do the same with 0002_security_guards.sql. Then run npm run rls-test with two test users to confirm the policies work.

Check package.json: if the build script is "next build --turbopack", change it to plain "next build". The Turbopack production build produced a broken app in our testing. Keep --turbopack on dev only.

Yes. In v1.2 the full app built from the pack went through a security review, and every fix is in the templates and rules: plan and billing columns locked in the database, free-plan limits enforced in the database, Pro granted only for an active Stripe subscription with duplicate webhooks ignored, stricter open-redirect checks (including URL-encoded tricks), Origin checks on checkout and billing, a nonce Content-Security-Policy, security headers and httpOnly cookies. One thing to do yourself: the included login rate limiter is in-memory, so swap it for your host's firewall or a shared store before launch.