Home / Windsurf rules

Windsurf rules that keep Cascade on track

Windsurf's Cascade agent follows workspace rules stored as Markdown files in .windsurf/rules/. Like Cursor rules, the trick is lots of small, scoped files rather than one big one.

How Windsurf rules load

• Always on: core project rules (stack, commands, never-do list).
• Glob: loads only when matching files are touched, e.g. supabase/**.
• Model decision / manual: the agent pulls them in when relevant, or you @-mention them.

Keep each file well under Windsurf's per-rule size limit, and mirror the core rules in AGENTS.md so other tools get them too.

Free rule: Supabase row-level security

This is the rule that saves the most money in a Next.js + Supabase app. It's written as a Cursor .mdc file; for Windsurf, drop the front matter, save it as .windsurf/rules/database-rls.md and set activation to Glob supabase/**.

- Each migration: create table + alter table ... enable row level security + policies, in one file.
- Policies use (select auth.uid()) for performance; separate policies per command (select/insert/update/delete).
- Add indexes on every column used in a policy or foreign key.
- Never disable RLS to 'make it work'. If a query fails, fix the policy and explain it.
- Regenerate types after schema changes.

The original file is free on GitHub: nextjs-supabase-rls.mdc.