Free rules / Lovable
Free Lovable rules
Lovable has no rules file in the repo. Instead it follows the Knowledge text you set in project or workspace settings on every request. This template covers the things that most often go wrong in Lovable apps: surprise redesigns, open Supabase tables and leaked keys.
How to install
- Open your project and go to Project settings → Knowledge (shortcut: Cmd/Ctrl + .).
- Paste the text below and fill in the ABOUT THIS PROJECT section.
- Save. Lovable applies it to every request in that project.
- Workspace owners can paste the HOW TO WORK and DATA sections into Workspace settings → Knowledge to apply them to every project.
The rules file
ABOUT THIS PROJECT (fill in)
- What it is: [one sentence: who it's for and what it does]
- Main pages / features: [e.g. landing, sign-up, dashboard, settings]
- Look and feel: [e.g. clean, light theme, brand color #4F46E5, rounded cards]
- Out of scope for now: [things you should NOT build yet]
HOW TO WORK
- Change only what I ask for. Don't redesign, rename or restyle anything else.
- Before a large change (new feature, new table, more than a few files), describe the plan in 3-5 bullets and wait for my OK.
- Build one feature at a time and make sure it works before starting the next.
- If my request is unclear, ask one short question instead of guessing.
- Reuse existing components and the existing design system (Tailwind + shadcn/ui). Don't add a second UI library.
- Keep components small and focused. Split files that grow past ~200 lines.
- Don't add new npm packages unless it's really needed, and tell me why.
DESIGN
- Every page must work on mobile (375px wide) and desktop.
- Use the theme tokens / Tailwind config for colors and spacing, not one-off hex values.
- Every image gets alt text, every input gets a label, and buttons must be reachable by keyboard.
- Show loading, empty and error states for anything that fetches data.
DATA AND BACKEND (Supabase)
- Turn on Row Level Security for every table, with policies so users can only read and write their own rows.
- Never put the Supabase service_role key, Stripe secret key, OpenAI/Anthropic key or any other secret in frontend code. Store secrets in Supabase secrets and call third-party APIs from an Edge Function.
- Validate inputs on the server side as well as in forms.
- Ask before deleting a table, dropping a column, or changing data that already exists.
AUTH
- Protect private pages: redirect signed-out users to sign in.
- Never trust a user id sent from the browser; use the authenticated user from Supabase.
WHEN YOU FINISH A CHANGE
- Tell me in plain English what you changed, which files, and anything I need to test or set up (for example a secret or an email setting).
- If an error appears, fix the root cause instead of hiding it.
Notes
- Each knowledge field holds up to 10,000 characters; this template is about 2,100, leaving room for your own notes.
If you export to GitHub and keep building in Cursor or Claude Code, the Mega Pack has rules for Next.js, FastAPI, Godot, Unity and discord.js. The Rules Mega Pack ($19) has them.
See how Lovable ranks on AgentRank (sister project)
Other tools: Cursor · Claude Code · Windsurf · Bolt