Home / DRW-06 Supabase + Next.js Agent Kit

Supabase + Next.js Agent Kit

DRW-06 · $19 · one-time. Drop-in instructions so Cursor, Claude Code, Codex and Windsurf build a Next.js App Router app on Supabase the same way, every time. It targets the mistakes agents make most on this stack:

• Tables with no RLS. A new table ships with no row level security, or with policies but the default grants still in place.
• Old auth helpers: @supabase/auth-helpers, getSession() trusted on the server, cookies handled by hand.
• The secret key in client code: sb_secret_… or the service role key imported into a client component.
• Untyped queries and hand-written row types that drift from the schema.
• Stripe access before payment: unlocking features from the success URL instead of a verified webhook.

What's in the zip

• AGENTS.md: the main rules file, read by Codex, Cursor, Windsurf, Aider and Zed. You fill in 5 fields: app name, Next.js version, package manager, deploy target and production domain.
• CLAUDE.md: the Claude Code entry point. It imports AGENTS.md.
• 8 scoped .cursor/rules/*.mdc rules that attach by path: core, structure, SSR auth, RLS migrations, typed queries, secret key, Edge Functions and Stripe webhooks.
• .claude/agents/migration-reviewer.md: a read-only Claude Code subagent that reviews each new migration.
• .claude/hooks/review-migration.sh + settings.json: a PostToolUse hook that blocks a new table or view unless the same file enables RLS and revokes default grants. It needs jq.
• 10 prompts: /plan /feature /migration /rls-audit /auth /edge-function /stripe-webhook /fix /review /ship.
• Definition-of-done and pre-launch checklists.

Sample rule

- Every CREATE TABLE in an exposed schema ships, in the same
  migration: enable row level security, revoke all from anon,
  authenticated, grant only the commands the app needs, and a
  separate policy per command.
- Policies filter with (select auth.uid()) and name the role
  in "to authenticated" / "to anon".
- Views: create view ... with (security_invoker = true).

Written for

Next.js 16 App Router (proxy.ts; on Next.js 15 the same @supabase/ssr code goes in middleware.ts), @supabase/ssr + @supabase/supabase-js with publishable and secret keys, Supabase RLS, generated types and Edge Functions, and Stripe Checkout webhook fulfillment. The rules follow each product's documentation as of October 2026. They haven't been run against a reference project yet, so if something misbehaves, email us and we'll fix it in an update.

Want the free version first? Cursor rules for Next.js + Supabase and Supabase RLS for AI agents are free guides.