How to stop Cursor and Claude Code breaking your project: a free AGENTS.md starter
If you build with Cursor, Claude Code, Copilot or Windsurf, you've probably had at least one of these happen: You asked for a small fix and the agent "tidied up" four other files. An API key ended up hard-coded in a component, or behind a NEXT_PUBLIC_ prefix where every visitor can read it. A new API route works perfectly, for every user, including the ones who shouldn't see that record. The agent tried the same broken fix five times, each one making things a bit worse. Tests were "fixed" by sk…