CLAUDE.md

Project root. Cursor users: save as AGENTS.md.

Part of Feedback Board with Voting and a Public Roadmap by Admin

Project rules: feedback board

What we are building

A public feedback board: people sign in, post ideas, upvote (once each) and comment. The admin sets a status (Under review, Planned, In progress, Done) and the public roadmap shows ideas grouped by status.

Stack

Next.js (App Router) + TypeScript + Tailwind + shadcn/ui
Supabase: Postgres, Auth (magic link), Row Level Security

Rules

Security lives in the database: RLS on every table. The UI hiding a button is not security.
One vote per user per idea, enforced by a unique constraint, not by the UI.
Vote counts come from the database (a view or count query), never from a number the client sends.
Only admins (profiles.is_admin) can change status or delete.
Server Actions for writes. Never expose the service role key to the browser.

Source, 16 lines

# Project rules: feedback board

## What we are building
A public feedback board: people sign in, post ideas, upvote (once each) and comment. The admin sets a status
(Under review, Planned, In progress, Done) and the public roadmap shows ideas grouped by status.

## Stack
- Next.js (App Router) + TypeScript + Tailwind + shadcn/ui
- Supabase: Postgres, Auth (magic link), Row Level Security

## Rules
- Security lives in the database: RLS on every table. The UI hiding a button is not security.
- One vote per user per idea, enforced by a unique constraint, not by the UI.
- Vote counts come from the database (a view or count query), never from a number the client sends.
- Only admins (profiles.is_admin) can change status or delete.
- Server Actions for writes. Never expose the service role key to the browser.