Ship-Safe Starter Kit

You can build an app with AI in a weekend. Then the AI rewrites a file you needed, your API key ends up in the code, or your database is open to anyone who opens the browser console.

The Ship-Safe Starter Kit is a set of drop-in files that make Cursor and Claude Code work the way a beginner needs: explain what they are doing in plain English, take small steps, ask before risky changes, and keep your secrets and your users' data safe.

It is written for people who are not professional developers: indie makers, solo founders, designers and creators shipping their first or fifth app with AI. No jargon you have to look up. Every technical term is explained the first time it appears.

What is inside

• 9 Cursor project rules in the current .cursor/rules/*.mdc format: beginner mode, protect-my-work (git safety), secrets and env vars, Supabase safety, auth and server routes, plan-before-building, calm debugging, packages, and a one-command pre-deploy review.
• A ready-to-use CLAUDE.md plus 2 file-specific rules for Claude Code, saying the same things, so both tools behave the same way.
• PRD template + a filled-in example. A one-page plan your AI reads before it builds, so it stops guessing.
• The plain-English git "undo" cheat sheet. "I broke it, how do I go back?" Each situation is matched to the exact command and marked safe, careful or danger. Every command was tested.
• Pre-deploy security checklist. Secrets, env vars, auth, Supabase Row Level Security, rate limits, spending caps, payments, error messages, dependencies, and an undo plan. Includes copy-paste test commands and an AI review prompt.
• A starter .gitignore and .env.example so your keys never get committed.
• A 10-minute quick-start guide with three install options, including "let your AI do it".

Why this kit - Beginner-first. Most rules packs are written for engineers. This one is written for you. - Safety-first. It focuses on the mistakes that actually hurt AI-built apps: leaked keys, open databases, lost work and runaway API bills. - Up to date. Formats were checked against the official Cursor and Claude Code docs in October 2026. The Supabase guidance covers the new publishable and secret API keys. - Works with both tools. Use Cursor, Claude Code, or both.

Good to know - Built around the most common beginner stack (Next.js + Supabase + Vercel). The rules are plain English and adapt to most web stacks. - Rules guide your AI; they cannot force it. The checklist is educational guidance, not a professional security audit. - Personal-use license: use it on all your own projects, including commercial ones. No resale or redistribution. - Digital download. You get a ZIP file. Nothing is shipped.

Questions

I have never used git. Is this for me? Yes. The cheat sheet starts from zero, and the rules remind your AI to save checkpoints for you. Does it work with Windsurf, Lovable, Bolt or Replit? The files are made for Cursor and Claude Code. The checklist, PRD and git cheat sheet work with any tool, and the rules text can be pasted into other tools' instructions. Do I need Supabase? No. The Supabase rule only activates on Supabase files. Everything else applies to any stack. Will my AI follow the rules 100%? No tool can guarantee that. The rules make good behaviour much more likely, and the checklist plus git are your safety net. Refunds? 14 days, full refund, no questions asked.

Independent product by Vibe Shipped. Not affiliated with, endorsed by, or sponsored by Cursor (Anysphere, Inc.) or Anthropic, PBC. Product names are used only to describe compatibility.