AI RULES · v2 · CLAUDE CODE + CURSOR

Rules are advice. v2 enforces them.

Guardrail hooks that stop your agent reading .env, running supabase db push, or importing the Stripe SDK into a client component. Plus 18 skills and 6 subagents for Next.js + Supabase + Stripe, tested against a working app.

Get v2 for $1.30 (UK $1.56 incl. VAT) · first 10 buyers

then $19 · ends 28 Oct, 18:59 UK or after 10 sales

Try the free v1 sample

One-off payment via Gumroad. Prices exclude VAT; UK and EU VAT is added at Gumroad checkout. Already own v1? You get v2 free, in your Gumroad library.

Ship-Ready AI Rules v2: Claude Code hooks denying supabase db push and a .env read, with 13 of 13 hook tests passing

What it blocks

What the v2 hooks block
Your agent tries to…The hook…
Read or write .env, or print secret env varsblocks it
Run supabase db push, --linked commands, Stripe live mode, --prod deploys, or git push --forceblocks it
Use the admin Supabase client, Stripe SDK, or server secrets in a client component, or add NEXT_PUBLIC_*SECRETblocks it
Say "done" while tests failtypechecks after every TS edit and blocks the claim

Why hooks

  • Enforced, not suggested. Hooks run every time; the agent can't forget them.
  • Specific to your stack. Skills cover getClaims / getUser server auth, RLS migrations with pgTAP tests, idempotent and order-safe webhooks, and entitlements, not generic "write secure code" prompts.
  • Fits your tools. Claude Code plugin or copy-in .claude/, Cursor rules, AGENTS.md for Codex/Copilot/Cline, and an .agents/skills mirror.

What's inside v2

  • 3 guardrail hooks
  • 18 skills: RLS migrations, RLS audit, server-side auth, Stripe Checkout + customer portal, hardened webhooks, subscriptions + entitlements, Server Actions, route handlers, testing (incl. pgTAP), pre-merge audit, /ship-check, /add-paid-feature, /deploy-checklist, and more
  • 6 subagents: code reviewer, security auditor, migration writer, Stripe integrator, test writer, build fixer
  • Demo app, 13 hook test groups, format validator: rerun everything with npm run verify
  • Everything from v1: rules, 29-point pre-launch security checklist, prompt library
  • Single-user commercial licence: unlimited projects of your own, including client work

New in v2 Changelog 2.0.0

Already own v1? v2 is an update to the same product, so you won't pay again. It's in your Gumroad library now.

  • Guardrail hooks: PreToolUse guard (secrets, remote DB, Stripe live, prod deploys, force push, client/server boundary, NEXT_PUBLIC_ secrets), PostToolUse typecheck, Stop test gate. 13 test groups.
  • Claude Code plugin ship-ready; passes claude plugin validate --strict.
  • 13 new skills (18 in total) and 6 subagents.
  • .agents/skills mirror for Cursor, Codex and other Agent Skills readers.
  • Auth guidance updated: getClaims() for pages, getUser() for mutations.
  • .claude/settings.json with permission deny rules and hook wiring.

What's tested

  • claude plugin validate in strict mode
  • A format validator
  • 13/13 hook script tests
  • Typechecks, unit tests, and next build on a sample Next.js + Supabase + Stripe app
  • Checks on the demo app

What this doesn't do

  • Hooks reduce risk. They don't replace reviewing your code.
  • Built for Next.js + Supabase + Stripe. Other stacks get little from the skills.
  • No live Supabase or Stripe run yet. It hasn't been run against a live Supabase project or Stripe account.

Pick a version

Free sample vs v1 vs v2
Free sample (GitHub)v1 (previous version)v2 ($19, available now)
AGENTS.md golden rules Yes Yes Yes
Stripe .mdc rule Yes Yes Yes
All 6 Cursor rules No Yes Yes
Claude Code skills No518
Subagents No No6
Guardrail hooks No No3
Claude Code plugin No No Yes
Reference/demo app No Yes Yes
LicenceMITSingle-user commercialSingle-user commercial

FREE SAMPLE · MIT

Free sample

Try the core rules in your repo.

$0

on GitHub

  • AGENTS.md golden rules
  • The complete Stripe .mdc rule
Get the free sample

MIT licence

AI RULES · V2 New in v2

Ship-Ready AI Rules v2

Rules are advice. v2 enforces them.

$19

one-off · free for v1 buyers

  • 3 guardrail hooks
  • 18 skills
  • 6 subagents
  • Claude Code plugin + Cursor rules + AGENTS.md
  • Demo app, 13 hook test groups, npm run verify
  • Everything from v1
Get v2: $19

Sold via Gumroad (merchant of record)

The mistakes v1 already prevents

Every one of these passes a click-through test. That's why they ship. The secure starting set of Cursor rules explains each one.

Mistakes the v1 rules prevent
What agents doWhat the rule enforces
Use the service/secret key in a page "to make the query work"Two clients: user client (RLS) vs admin client (webhooks only)
Create tables and "add RLS later"RLS + policies in the same migration
Call request.json() before verifying Stripe webhooksRaw body → constructEvent → idempotency by event id
Grant access on the Checkout success URLAccess only from the webhook-mirrored subscription
Redirect to whatever ?next= sayssafeNext(): relative paths only

Stop the bug before the agent writes it

Get Ship-Ready AI Rules v2: $19

Not affiliated with Anthropic, Supabase, Stripe, or Vercel.

FAQ

What do the guardrail hooks block?
They block reading or writing .env secrets and printing secret env vars; supabase db push, --linked commands, Stripe live mode, --prod deploys and force pushes; and the admin Supabase client, the Stripe SDK or server secrets in client components, plus NEXT_PUBLIC_*SECRET variables. They also typecheck after every TypeScript edit and won't let Claude say it's done while tests fail.
Does it work with Cursor, Codex or Copilot?
Yes. It ships as a Claude Code plugin or a copy-in .claude/ folder, plus Cursor rules, AGENTS.md for Codex, Copilot and Cline, and an .agents/skills mirror. The hooks are Claude Code specific.
I bought v1. Do I pay again?
No. v2 is a free update for existing v1 buyers.
How is it tested?
Every code snippet in the skills compiles with tsc, is unit-tested and goes through next build against Next.js 16, Stripe SDK 23 and supabase-js 2. The plugin passes claude plugin validate --strict, and 13 hook test groups are included so you can re-run everything with npm run verify.
Can I use it for client work?
Yes. The single-user commercial licence covers unlimited projects of your own, including client work.

Further reading