# Next.js 15 + Supabase Architecture

> 27 rules preventing common Supabase and Next.js 15 AI hallucinations

Source: https://aistack.sh/rule/nextjs15-supabase-security
Real source: https://github.com/PatrickJS/awesome-cursorrules/blob/main/rules/nextjs15-supabase-cursorrules-prompt-file.mdc
Author: awesome-cursorrules community (curated by PatrickJS)
Category: cursor-rule
Stack: Next.js, Supabase, TypeScript
Last verified: 2026-09-06

27 architecture rules aimed at preventing AI hallucinations in a Next.js 15 and Supabase app: insecure auth (getSession vs getUser), synchronous params, deprecated imports, missing row-level security, and Stripe key exposure. Built for Cursor Agent and Claude Code.

## Install

### cursor

```
mkdir -p .cursor/rules
curl -o .cursor/rules/nextjs15-supabase-cursorrules-prompt-file.mdc https://raw.githubusercontent.com/PatrickJS/awesome-cursorrules/main/rules/nextjs15-supabase-cursorrules-prompt-file.mdc
```

Per the repo's own instructions: create a .cursor/rules/ directory in your project, then copy the .mdc file into it. Cursor auto-attaches the rule based on the globs in its frontmatter.

---

From aistack.sh. Last verified 2026-09-06.