Rules your AI follows every time
Free generator · Claude Code · Cursor · AGENTS.md (many tools) · Lovable, Bolt or v0
A rules file is a set of standing instructions your AI coding tool reads before every request: CLAUDE.md for Claude Code, a .cursor/rules file for Cursor, AGENTS.md for many other agents, or the project knowledge setting in app builders. Put your safety rules there once, and the AI follows them without you repeating them in every prompt.
CLAUDE.md
19 rules
# CLAUDE.md
This is a Next.js project. Follow these rules on every task. If a request would break one, say so and ask before going ahead.
## Work habits
- Before any change touching more than two files, explain the plan and wait for my OK.
- Change only what I asked for. Don't refactor, rename or reformat other code.
- After each change, list every file you changed with one line on why.
- When something fails, explain the cause before trying a fix. After two failed fixes, stop and tell me what you know and don't know.
- Never delete, skip or weaken a test to make it pass. If a test fails, tell me why.
- Before installing a package, check it exists, is widely used and is maintained, and tell me why it's needed.
## Security
- Never put secret keys in browser code. Variables starting with NEXT_PUBLIC_ are public: never use that prefix for a secret.
- Every API route and server action must check that the user is signed in and allowed to act on the specific record.
- Take the user's identity from the server session, never from an id sent in the request.
- Validate all input on the server: types, lengths, ranges. Never trust limits that exist only in the form.
- Never log passwords, tokens, keys or full request bodies.
## Database (Supabase)
- Every new table gets Row Level Security turned on in the same migration, with policies that limit rows to their owner.
- Never use the service role key in browser code. In server code, use it only when there's no other way, and check permissions yourself.
- Never run destructive SQL (drop, truncate, delete without where, reset) without asking me first and naming the database it runs on.
- Make schema changes as migration files, never by hand on the production database.
## Git and commands
- Never run git push --force, git reset --hard or git clean, and never delete branches, without asking.
- Ask before running any command that deletes files, changes the database, deploys or spends money.
- Never commit .env files or anything containing a key. Check .gitignore covers them.
- Suggest a commit with a clear message whenever a feature works.
<!-- Generated with LogicTrail: https://logictrail.app/guides/ai-rules-files -->
Save it as CLAUDE.md in your project's root folder. Claude Code reads it at the start of every session.
Questions
- What is CLAUDE.md?
- A Markdown file in your project's root that Claude Code reads at the start of every session. Use it for project facts and rules the agent must always follow, such as never committing .env files.
- Where do Cursor rules go?
- In .cursor/rules as .mdc files. A rule with alwaysApply: true in its header is included in every request. The older single .cursorrules file still works in many setups but is being replaced by this folder.
- Does a rules file guarantee the AI follows it?
- No. It makes the rules part of every request, which helps a lot, but AI tools can still slip. Keep approvals on for risky commands and review changes, especially to permissions and payments.
- What is AGENTS.md?
- An open, tool-neutral file for instructions to coding agents, placed in the project root. A growing number of AI coding tools read it, so it's a good choice if you use more than one.
Rules set the limits; prompts do the work. Pair this with the prompt library, and see what these rules prevent in Working with your AI agent.