Disclosure: I run AgentCartridge, which sells paid rules packs. This rules file is free and needs no signup. The page also has a link to one of our paid packs further down.
Whenever I let the agent write web app code, it kept making/repeating the same five mistakes, so I wrote a rules file that addresses those mistakes:
- Secrets in client code or the repo (for example a key behind a NEXT_PUBLIC_ or VITE_ variable, or a committed .env)
- Missing security headers (CSP, HSTS, nosniff, Referrer-Policy)
- Weak HTTPS assumptions (http:// URLs, cookies without Secure/HttpOnly/SameSite)
- Broken asset and link paths (local file paths, wrong-case file names, links to routes that no longer exist)
- Fat client bundles (importing a whole library for one function)
Setup: save it as .cursor/rules/ship-safe.mdc with alwaysApply: true. The same body also works pasted into CLAUDE.md or AGENTS.md. Then ask the agent to review your current code against it once.
The full file is on the page, so you can copy it directly: Ship-Safe Rules for Cursor & Claude Code: Stop 5 Common Vibe-Coding Fails | AgentCartridge
If one of the rules is wrong for your stack or too strict, let me know and I’ll fix it.