Vibe coding

Start a project

1. Create a project in the console and copy the develop environment's URL and keys. Your framework quickstart shows where each one goes.

2. Save the agent prompt as a project rule so every conversation starts with it:

   Tool	Where
   Cursor	.cursor/rules/
   Claude Code	CLAUDE.md
   Codex and other agents	AGENTS.md
   ChatGPT, Claude	Project instructions

3. Ask for one feature at a time, and run it before asking for the next.

Prompts by feature

Each one points the assistant at the page that documents the feature. Replace the parts in angle brackets.

Build sign-up, sign-in and password recovery for my <framework> app. Follow
https://www.nulvless.com/llms.mdx/docs/guides/sign-up/content.md and
https://www.nulvless.com/llms.mdx/docs/sdk/auth/content.md.

Add Google and GitHub sign-in with a /callback route. Follow the authorize
section of https://www.nulvless.com/llms.mdx/docs/sdk/auth/content.md and tell
me what to enable and allowlist in the console.

Protect every page under /app and check permissions in my API routes. Follow
https://www.nulvless.com/llms.mdx/docs/sdk/events/content.md and
https://www.nulvless.com/llms.mdx/docs/guides/authorization/rbac/content.md.

Let an organization owner invite members by email and let them accept at
/join. Follow
https://www.nulvless.com/llms.mdx/docs/guides/authorization/invitations/content.md.

Build a security settings page where the user enables an authenticator app
and gets recovery codes. Follow
https://www.nulvless.com/llms.mdx/docs/guides/mfa/content.md and
https://www.nulvless.com/llms.mdx/docs/guides/sudo/content.md.

Send the "<slug>" email template from my server when <event>. Follow
https://www.nulvless.com/llms.mdx/docs/guides/communications/content.md.

Never expose in the client

Anything in a browser bundle can be read by anyone. Only the publishable key (pk-…) is meant to ship.

• Secret key (sk-…) — server environment variables only, never with a NEXT_PUBLIC_ or VITE_ prefix, never committed.
• Provider secrets — OAuth client secrets, email and SMS credentials, the captcha secret. They live in the console, not in your code.
• Tokens and one-time codes — never logged, never in a URL.

If a secret key leaks, replace it as described in API keys.

Review what the assistant wrote

• No sk- or secret variable in code that reaches the browser.
• createServerClient only in server files.
• Every error from { data, error } is handled.
• Permissions are checked on the server, not by hiding buttons.
• Every method it called exists in the SDK reference.