24 rules & prompts · $19 one-time

Your AI writes the code.
We keep it from shipping disasters.

24 drop-in rules and prompts that tell your AI coding tool not to hardcode API keys, skip auth checks, grant free access on Stripe redirects, leave Supabase tables open, or delete code you didn't ask it to touch.

CursorClaude CodeCodex · AGENTS.mdLovableBoltv0ReplitChatGPT

Tested in public, misses included: the rules helped on Supabase RLS and did nothing for Stripe. See every output →

30-day refund. If it isn't useful to you, email team@vibeguardrails.com or reply to your receipt and we'll refund it. No questions.

Built for people who ship with AI

⚠

The problem

AI tools are great at making apps that work in the demo. Left alone, they'll also put secret keys in the browser, leave database rows readable by anyone, and trust whatever price the client sends.

⛨

The fix

Plain-text rules your AI reads on every request, plus prompts to audit, debug and deploy. Each rule ends with a short checklist so you can confirm it worked.

◆

4 formats, every item

.cursor/rules/*.mdc, CLAUDE.md, AGENTS.md, and paste-in text for Lovable, Bolt, v0 and Replit. Install takes about a minute.

On a real laptop

Real MacBook photos of our storefront and free sample. Cropped and retouched to remove creator controls and desktop clutter.

vibeguardrails.com open in Safari on a MacBook, showing the $19 Ship-Safe Pack and the 3 free rules
The pack page: 24 rules & prompts, $19 one-time.
The free 3-rule sample on a MacBook: paste AGENTS.md into your project, including the Supabase row level security rule
The free sample: drop one AGENTS.md into your project.

What's inside

.mdc · CLAUDE.md · AGENTS.md · paste-in

14 rules files

  • Secrets & Environment VariablesNever hardcode or expose API keys, tokens or passwords; keep secrets server-side.
  • Supabase Row Level SecurityEvery Supabase table has RLS enabled with explicit per-user policies; no service_role in the client.
  • Auth & Session SafetyAuthorize every request on the server; never trust the client about who the user is.
  • Stripe & Payment Safety (rule 04 not yet tested)Prices come from the server, fulfillment happens only in verified webhooks, and webhooks are idempotent.
  • Input ValidationValidate every external input with a schema at the boundary.
  • Rate Limiting & Abuse ProtectionLimit auth, AI and expensive endpoints so one user or bot cannot run up your bill.
  • Error Handling & LoggingFail loudly in logs, gently for users; never swallow errors or leak internals.
  • Safe Database MigrationsSchema changes go through reviewed, reversible migration files; never destroy data.
  • Scope Guard: Don't Delete My CodeChange only what was asked; never remove working code, features or files silently.
  • One Feature at a TimeWork in small, verified steps with a working app after each one.
  • Dependency & Package SanityAdd only real, maintained, necessary packages and keep the lockfile honest.
  • Accessibility BaselineSemantic, keyboard-usable, labelled UI that meets WCAG 2.2 AA basics.
  • Performance & Bundle DisciplineKeep pages fast: server-render data, avoid waterfalls, ship less JavaScript.
  • Testing MinimumA small set of tests that protect money, auth and data paths.
copy · paste · run

10 power prompts

  • Pre-Launch Security AuditRun a full security review of the app before real users arrive.
  • Explain This Codebase to MeGet a plain-English map of an AI-built project you no longer fully understand.
  • Debug Loop BreakerStop the AI from going in circles on the same bug.
  • Refactor Without Breaking ThingsClean up messy AI-generated code while keeping behavior identical.
  • Generate a Test SuiteCreate a focused test suite that protects the parts of the app that matter.
  • Production Deploy ChecklistWalk through everything needed to deploy safely to Render, Vercel or similar.
  • I Leaked an API Key: Fix ItContain and clean up an exposed secret step by step.
  • Privacy Policy & Terms ChecklistInventory what the app collects so you can write accurate legal pages.
  • Lovable/Bolt to Cursor MigrationMove an app built in Lovable, Bolt or Replit into a local repo you control.
  • Handoff Doc for a Human DeveloperProduce the document a freelancer needs to pick up your project fast.

Our test, misses included

We ran the same Supabase + Stripe app prompt 6 times, 3 with no rules and 3 with our free rules, and published every raw output. The rules helped on Supabase RLS. They did nothing for Stripe. The Stripe rule in the Ship-Safe Pack (rule 04) was not part of that test, so we can't tell you yet how well it works. One model, 3 runs a side: a demonstration, not a benchmark.

See every output on GitHub →

Two tiers. Instant download.

One-time payment. Instant download.

24 rules & prompts

Ship-Safe Pack

$19
  • All 24 rules & prompts
  • 4 formats each
  • Install guide

Buy now — $19 →

Secure checkout via Gumroad.

30-day refund. If it isn't useful to you, email team@vibeguardrails.com or reply to your receipt and we'll refund it. No questions.

Pro

Pro Kit

$39
  • Everything in Ship-Safe (24 items)
  • Supabase, Stripe, Next.js, Firebase & Vercel/Render rules
  • Pre-launch security audit mega-prompt
  • Secrets leak scanner + production readiness review
  • Cursor, Windsurf, Claude Code, Lovable/Bolt formats
  • Free lifetime updates

Get Pro — $39 →

Secure checkout via Gumroad.

30-day refund. If it isn't useful to you, email team@vibeguardrails.com or reply to your receipt and we'll refund it. No questions.

Get 3 rules free

Secrets & env vars, Supabase RLS, and the "don't delete my code" scope guard, in all four formats.

Want launch news and new rules as they drop?

Subscribe on Gumroad. Opens in a new tab, unsubscribe anytime.

✉ Get launch updates & new rules →

FAQ

Do I need to code?

No. Paste-in versions work in Lovable, Bolt, v0 and Replit. The prompts are written in plain English.

Does this guarantee my app is secure?

No tool can. These rules make common, costly mistakes much less likely and give you checklists to verify. Still review what you ship.

License?

Single user; use in unlimited personal and client projects. Please don't resell the files.