Skip to content
vibespell

.cursor/rules/security.mdc

Cursor security rule for Next.js + Supabase

A focused Cursor `.mdc` rule for auth, secrets, and untrusted input. It attaches when those files change, instead of repeating security policy in every chat. This copy is written for a Next.js + Supabase project. This repository is a Next.js app using Supabase. The browser uses the anon key only. Row Level Security is the authorization layer, and the service role stays on the server.

The example uses a balanced, readable style, pragmatic tests, and comments only where the intent is not obvious. Open the generator to make the agent stricter, switch to test-first, quiet the comments, or pick a different file.

The example assumes Next.js App Router plus Supabase. It does not assume a particular component library. If the repo uses `@supabase/ssr`, keep that cookie pattern.

Customize in the generatorBrowse the library

Example file

Balanced strictness, readable style, pragmatic tests. Download name: security.mdc

---
description: "Security rules for a Next.js + Supabase repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---

# Security rules

Attach these rules when editing auth, config, or secret-handling code in this Next.js + Supabase repository.
This repository is a Next.js app using Supabase. The browser uses the anon key only. Row Level Security is the authorization layer, and the service role stays on the server.

## Secrets and trust

- The service role key stays on the server.
- Every user-owned table has an RLS policy. Do not add a table without one.
- Validate ids from the client before calling an RPC.

## Errors

- Fail at the boundary. Do not swallow errors.
- Return a clear error when RLS hides a row or the session is missing. Do not leak the service-role error to the browser.

## Done when

- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- The dev server renders the change, and a policy or type update is included when the table changed.

Add it to the project

  1. 01

    Copy a starting file

    Copy the example Cursor security rule on this page, or open the generator if you want different testing, strictness, or comment rules.

  2. 02

    Save it at .cursor/rules/security.mdc

    Save it at `.cursor/rules/security.mdc` in the Next.js + Supabase repo. Narrow the globs if your auth and config files live in a known folder.

  3. 03

    Start a fresh agent session

    Rules files are read when a session starts. A chat that is already open may still be using the old instructions.

  4. 04

    Give it one small task

    Ask for one change a Next.js + Supabase agent often gets wrong, such as a server query that uses the user-scoped client, not the service role. If it ignores the file, confirm the path and start a new session.

Questions about this file

Where do I put Cursor security rule in a Next.js + Supabase repo?

Save it at `.cursor/rules/security.mdc` in the Next.js + Supabase repo. Narrow the globs if your auth and config files live in a known folder.

Which tools read this Cursor security rule?

Cursor loads `.cursor/rules/security.mdc` for files that match its globs. Pair it with the always-on project rule. It is not a substitute for code review.

What does the Next.js + Supabase example assume?

The example assumes Next.js App Router plus Supabase. It does not assume a particular component library. If the repo uses `@supabase/ssr`, keep that cookie pattern.

Does VibeSpell upload my repository?

No. Recipe pages are static, and the generator builds the file in your browser from the options you pick. Your source code never leaves the machine.

Other files for Next.js + Supabase

Cursor security rule for other stacks