Your AI writes the code.
Vibe Guardrails keeps it from shipping disasters.

The problem

AI tools are great at making apps that work in the demo. Left alone, they'll also put secret keys in the browser, leave database rows readable by anyone, and trust whatever price the client sends.

The fix

Plain-text rules your AI reads on every request, plus prompts to audit, debug and deploy. Each rule ends with a short checklist so you can confirm it worked.

4 formats, every item

.cursor/rules/*.mdc, CLAUDE.md, AGENTS.md, and paste-in text for Lovable, Bolt, v0 and Replit. Install takes about a minute.

14 rules files

• Secrets & Environment VariablesNever hardcode or expose API keys, tokens or passwords; keep secrets server-side.
• Supabase Row Level SecurityEvery Supabase table has RLS enabled with explicit per-user policies; no service_role in the client.
• Auth & Session SafetyAuthorize every request on the server; never trust the client about who the user is.
• Stripe & Payment SafetyPrices come from the server, fulfillment happens only in verified webhooks, and webhooks are idempotent.
• Input ValidationValidate every external input with a schema at the boundary.
• Rate Limiting & Abuse ProtectionLimit auth, AI and expensive endpoints so one user or bot cannot run up your bill.
• Error Handling & LoggingFail loudly in logs, gently for users; never swallow errors or leak internals.
• Safe Database MigrationsSchema changes go through reviewed, reversible migration files; never destroy data.
• Scope Guard: Don't Delete My CodeChange only what was asked; never remove working code, features or files silently.
• One Feature at a TimeWork in small, verified steps with a working app after each one.
• Dependency & Package SanityAdd only real, maintained, necessary packages and keep the lockfile honest.
• Accessibility BaselineSemantic, keyboard-usable, labelled UI that meets WCAG 2.2 AA basics.
• Performance & Bundle DisciplineKeep pages fast: server-render data, avoid waterfalls, ship less JavaScript.
• Testing MinimumA small set of tests that protect money, auth and data paths.

10 power prompts

• Pre-Launch Security AuditRun a full security review of the app before real users arrive.
• Explain This Codebase to MeGet a plain-English map of an AI-built project you no longer fully understand.
• Debug Loop BreakerStop the AI from going in circles on the same bug.
• Refactor Without Breaking ThingsClean up messy AI-generated code while keeping behavior identical.
• Generate a Test SuiteCreate a focused test suite that protects the parts of the app that matter.
• Production Deploy ChecklistWalk through everything needed to deploy safely to Render, Vercel or similar.
• I Leaked an API Key: Fix ItContain and clean up an exposed secret step by step.
• Privacy Policy & Terms ChecklistInventory what the app collects so you can write accurate legal pages.
• Lovable/Bolt to Cursor MigrationMove an app built in Lovable, Bolt or Replit into a local repo you control.
• Handoff Doc for a Human DeveloperProduce the document a freelancer needs to pick up your project fast.

Ship-Safe Pack

• All 24 rules & prompts
• 4 formats each
• Install guide

Do I need to code?

No. Paste-in versions work in Lovable, Bolt, v0 and Replit. The prompts are written in plain English.

Does this guarantee my app is secure?

No tool can. These rules make common, costly mistakes much less likely and give you checklists to verify. Still review what you ship.

License?

Single user; use in unlimited personal and client projects. Please don't resell the files.