Built on Google's June 2026 "New SDLC with Vibe Coding" report

Stop your AI agent from writing spaghetti code.

Vibe coding gets you an 80% prototype. This kit — .cursorrules, a working Next.js + Supabase + Polar boilerplate, and a senior-engineer playbook — gets you the last 20% to production. For Cursor, Claude Code & Windsurf.

Free: generate rules for your stack →Get the full kit — $19

One-time payment · Lifetime updates · Instant download

The 80% problem, in plain terms

Google's report says it out loud: vibe coding is great for prototypes but stalls at ~80%. The last 20% — auth, database rules, payments, deployment — is where AI agents silently break things. Here's exactly where, and the fix.

✕
Confirming payment on the success redirect
→ Payment state changes ONLY from a signature-verified webhook.
✕
Row Level Security off (anon key reads every row)
→ RLS on every table, policy auth.uid() = user_id.
✕
Storing money as a float (0.1 + 0.2 ≠ 0.3)
→ Integer cents, always.
✕
Trusting getSession() cookie for server auth
→ Use getUser() — verified against the auth server.
✕
Unvalidated request bodies hitting your logic
→ Zod validation at every boundary, before the logic.
✕
Leaking stack traces & SQL in error responses
→ Generic message to client, detail to the logger only.

How it works

From the downloaded .zip to a live app — here's exactly what happens on your screen at each step.

1

Copy the starter — it becomes your project

unzip → rename → open in your editor
my-app/
my-app/ ← was starter/
├─ .cursor/rules/ AI rules
├─ CLAUDE.md
├─ .windsurfrules
├─ app/ pages + API
├─ lib/ your logic
├─ templates/ PRD, tasks
└─ CHECKLIST.md

Unzip, rename starter/ to your project name, and open it in Cursor, Claude Code, or Windsurf.

Everything is already inside: the rule files that discipline the AI, the templates you fill in, and working code for login, database, and payments.

2

Write your idea into the spec

templates/PRD.md · ~10 minutes

Open templates/PRD.md and describe your app: what it does, who it's for, and — critically — what's out of scope.

This is the step most people skip and then wonder why the AI wanders. Ten honest minutes here saves hours of the agent building the wrong thing.

PRD.md
1# One-liner
2A tool that turns voice notes
3into tidy to-do lists.
4
5# Target user
6Busy freelancers on mobile.
7
8# OUT of scope (v1)
9- teams / sharing
10- mobile app (web only)
3

Let the AI build — one task at a time

paste one prompt · the rules keep it on track
Cursor / Claude Code — chat
Read PRD.md and the rule files. Implement task 1 from tasks.md. Follow all project rules.
Plan: add the notes table (migration + RLS), lib/notes.ts, and a minimal list UI. Stack unchanged.
✓ migration created  ✓ RLS enabled  ✓ input validated
● working on the UI…

You give it one small task, not "build the app." Because the rule files are loaded, the agent states a plan, keeps your stack, and adds security you'd normally forget — RLS validation auth.

Repeat per task. This is the difference between an 80% toy and shippable software.

4

Run the checklist, then ship

CHECKLIST.md · build · deploy to Vercel

When the app works, open CHECKLIST.md and go top to bottom — each item has a copy-paste prompt. Then build and deploy.

Green build, real login, real payment — live on your domain. That's the last 20% closed.

terminal
$ npm run build
✓ Compiled successfully
✓ 0 type errors · 0 lint errors
$ vercel --prod
✓ Deployed → my-app.com
https://my-app.com
Your app — live
login · database · payments, all working
Sign upLog in
Copy
starter → my-app
→
Spec
fill PRD.md
→
Build
AI + rules
→
Ship
checklist → live

What's in the kit

Everything is enforced automatically inside your AI editor.

🧠 Folder-targeted rule files

.cursor/rules, CLAUDE.md and .windsurfrules that pin your stack, force spec-reading, and block the agent from rewriting working code.

⚙️ Working boilerplate

Next.js 15 + Supabase auth + Polar payments, wired and build-tested. Auth guard, RLS migrations, signature-verified idempotent webhooks.

📋 The Production Playbook

12 real traps AI-built apps die on, with the exact fix — the senior-engineer knowledge vibe coding never teaches.

✅ Spec templates + ship checklist

PRD.md, architecture.md, tasks.md and an 80%→100% checklist with copy-paste prompts for your agent.

$19 $39

One-time. Lifetime updates. Instant download.

Get the Vibe-to-Production Kit

Secure checkout via Polar · VAT handled · works with Cursor, Claude Code & Windsurf

Get the free report cheat sheet

The critical points of Google's "New SDLC with Vibe Coding" report + one free rule file. No spam — just the summary and a link.

FAQ

Does this work with Claude Code and Windsurf, not just Cursor?

Yes. The kit ships rule files for all three: .cursor/rules, CLAUDE.md, and .windsurfrules.

Stripe instead of Polar?

Supported — two files change, and the swap points are marked with comments.

Is the boilerplate actually tested?

Yes — it builds with zero type errors and the auth, checkout and webhook routes were verified live (401 on unauthenticated checkout, 403 on bad webhook signatures).

What do I need to run it?

A free Supabase project and a Polar account. The README walks you through both in ~20 minutes.