7 security bugs AI agents write in Next.js + Supabase + Stripe apps (and the rules that stop them)

RLS that protects nothing, service-role key leaks, unverified webhooks and more — with fixed code and an AGENTS.md rule for each.