Shared spell
Cursor security rule for Next.js + Supabase
This configuration is stored in the URL. Change a setting and copy a new link. Nothing is saved on a server.
Loading the generator…
Shared spell
This configuration is stored in the URL. Change a setting and copy a new link. Nothing is saved on a server.
Loading the generator…
---
description: "Security rules for a Next.js + Supabase repository"
globs: "**/*{auth,Auth,secret,config,Config}*"
alwaysApply: false
---
# Security rules
Attach these rules when editing auth, config, or secret-handling code in this Next.js + Supabase repository.
This repository is a Next.js app using Supabase. The browser uses the anon key only. Row Level Security is the authorization layer, and the service role stays on the server.
## Secrets and trust
- The service role key stays on the server.
- Every user-owned table has an RLS policy. Do not add a table without one.
- Validate ids from the client before calling an RPC.
## Errors
- Fail at the boundary. Do not swallow errors.
- Return a clear error when RLS hides a row or the session is missing. Do not leak the service-role error to the browser.
## Done when
- Untrusted input is validated before a side effect.
- No secret was added to source, logs, or a client bundle.
- The dev server renders the change, and a policy or type update is included when the table changed.