How to stop Cursor and Claude Code breaking your project: a free AGENTS.md starter

A developer published a free, MIT-licensed starter repo, vibe-coding-rules-starter, that gives AI coding agents like Cursor, Claude Code, Copilot and Windsurf a shared AGENTS.md rule file, with CLAUDE.md and .cursor/rules files pointing back to it. The template sets an explicit rule-priority order that puts security guardrails above user requests, and adds concrete prohibitions on destructive commands, dependency installs and scope creep, plus a two-attempt limit on debugging before the agent stops and summarizes options.

If you build with Cursor, Claude Code, Copilot or Windsurf, you've probably had at least one of these happen: NEXT PUBLIC prefix where every visitor can read it. None of this is the model being stupid. It's the model doing exactly what it was asked, with no idea what you consider off-limits. The fix is cheap: give it a short, clear set of house rules it reads at the start of every session. Most AI coding tools now read a plain Markdown instructions file from your project: | Tool | File it reads | |---|---| | Cursor, Copilot, Windsurf, Codex, Zed, Amp and others | AGENTS.md | | Cursor project rules | .cursor/rules/ .mdc | | Claude Code | CLAUDE.md | AGENTS.md is the closest thing to a shared standard, so it makes sense to put the real rules there and have the other files point at it. That's the setup I'll walk through below. All the files are in a free, MIT-licensed repo: vibe-coding-rules-starter https://github.com/theodorecreatesco/vibe-coding-rules-starter . The most useful thing you can tell an agent is what to do when instructions clash. Without that, "just make it work" quietly beats "don't commit secrets". The starter opens with this: Rule priority When rules clash, follow the higher one and say which you followed: 1. Security guardrails next section : never broken, even if I ask. Explain the risk in one line and do the safe version. 2. The task I asked for : it's my OK for the changes it clearly needs, within the guardrails. List them under "Needs your OK". 3. Stack conventions the conventions already used in this repo . 4. Working style. "Say which you followed" matters. It turns a silent decision into one you can see in the reply. "Write secure code" does nothing. Rules the agent can act on look like this: - Public prefixes NEXT PUBLIC , VITE , EXPO PUBLIC , PUBLIC ship values to every user: never put a secret behind one. Work that needs a secret moves to a server or edge function. - Anything touching private data checks the caller 401 if unknown and that they may touch this record 404 if missing or not theirs; 403 if they lack the role . Hiding a button isn't security. - Admin features need sign-in plus a role stored in the database and checked on the server, never a client flag or hard-coded emails or IDs. The second rule is the one that prevents the most common hole in AI-built apps: an endpoint that checks you're logged in but not that the record is yours . Change the ID in the URL and you're reading someone else's data. It also helps to list the things the agent must never do on its own: Never, in any mode, unless I ask for that exact action - Destructive commands rm -rf , git reset --hard , git push --force , dropping tables, database resets , changing a remote or production database, or disabling, skipping or loosening tests, lint rules or type checks to get a pass. - Installing new dependencies without my OK. Check a package's exact name before installing typo-squats are common . Most "the AI broke my project" stories are scope problems, not security ones. These lines do most of the work: - Stay in scope: don't rename, reformat or tidy unrelated code. - Make the smallest change; never rewrite a working file wholesale. - Never invent APIs, packages or file paths. Check the installed version's docs. - Debugging: reproduce, read the full error, state the likely cause, make the smallest fix. After two failed attempts, stop and summarise the next two options. The two-attempt limit is what stops the debugging spiral. Instead of a sixth guess, you get a summary and a choice. For anything bigger than two files, the agent writes a short plan first and waits for your OK. If it's running as a background agent and can't ask, it puts the plan at the top of its summary instead of stalling. Finally, tell the agent what "done" looks like: Reply with: 1 what changed, 2 the files changed, 3 the commands you ran and their results, 4 how I can test it, 5 "Needs your OK": anything I should confirm, plus anything risky or unfinished. Point 3 is the important one. "I ran npm test , 41 passed, lint couldn't run because…" is something you can trust. "Everything should work now" isn't. Cursor. AGENTS.md is picked up automatically, but a project rule with alwaysApply: true makes sure the security section is in every chat, even if AGENTS.md gets cut short: --- description: Rule priority and security guardrails that apply to every task alwaysApply: true --- Claude Code. CLAUDE.md can import another file with @ , so it stays short and repeats only the security essentials as a backup: @AGENTS.md AGENTS.md imported above holds the full project rules. This file repeats the essentials so they still apply if AGENTS.md is missing or cut short; if they ever differ, the security rules here win. From the root of your project: git clone --depth 1 https://github.com/theodorecreatesco/vibe-coding-rules-starter.git /tmp/vcrs cp /tmp/vcrs/AGENTS.md /tmp/vcrs/CLAUDE.md . mkdir -p .cursor/rules && cp /tmp/vcrs/.cursor/rules/security.mdc .cursor/rules/ Already have an AGENTS.md or CLAUDE.md ? Don't overwrite it. Paste the block between the BEGIN and END markers at the top of yours. Check it worked: start a new chat and ask "What are the top rules in this project?" It should mention the rule priority and the security guardrails. If it doesn't, the file isn't being loaded. Check it's in the project root, and for Cursor, that the .cursor folder hidden by default was copied. Rules reduce mistakes, they don't guarantee anything. The repo also includes a 10-point checklist to run before you share a link. A few of the checks: - .env and .env. are listed in .gitignore and .env.example holds names only . Check: git check-ignore -q .env.local should exit with code 0. - Every API route, server action and edge function checks the user is logged in - Every one also checks the user owns or may access the record - Spending limits or alerts are set on paid APIs OpenAI, Anthropic, etc. and hosting There's also a copy-paste "secret scan" prompt that gets your agent to check the repo and git history, if it can for keys, without printing the values. You don't need a huge rules file. A clear priority order, specific security rules, a scope limit and a "show me what you ran" report fix most of the damage AI coding tools do. Grab the files from vibe-coding-rules-starter https://github.com/theodorecreatesco/vibe-coding-rules-starter , and if you improve on them, issues and PRs are welcome. If you want versions tuned for a specific stack Next.js + Supabase, Lovable, Bolt, FastAPI, Expo and others with a one-command installer, I also sell a full Vibe Coding Rules Kit https://www.etsy.com/uk/listing/4601953941 . The free starter works fine on its own. Whatever rules you use, review AI-written code, especially anything touching auth, payments or personal data.