Use BeforeMerge with AI coding tools

# Code Review Rules (from BeforeMerge)

## Security: Avoid raw SQL in Server Actions
Raw SQL queries in Server Actions bypass Row Level Security.
Always use the Supabase query builder or parameterized queries.

### Bad
```ts
const { data } = await supabase.rpc('raw_query', {
  sql: `SELECT * FROM users WHERE id = '${userId}'`
});
```

### Good
```ts
const { data } = await supabase
  .from('users')
  .select('*')
  .eq('id', userId);
```

## Performance: Avoid N+1 queries in React Server Components
Do not fetch related data inside .map() or loops in RSCs.
Fetch all related data in a single query with joins or .in() filters.

# Code Review Rules

Follow these BeforeMerge rules when reviewing or writing code:

## Security rules
- https://www.beforemerge.com/rules/abc12345-avoid-raw-sql-in-server-actions
- https://www.beforemerge.com/rules/def67890-validate-server-action-inputs

## Full collection
- https://www.beforemerge.com/collections/ghi11223-owasp-top-10

#!/bin/bash
# Fetch BeforeMerge rules and append to CLAUDE.md
API_KEY="bm_your_key_here"
BASE_URL="https://www.beforemerge.com/api/v1/public"

# Fetch a specific rule's full body
curl -s "$BASE_URL/rules/abc12345-avoid-raw-sql" \
  -H "Authorization: Bearer $API_KEY" \
  | jq -r '.data.body' >> CLAUDE.md

# Fetch all rules from a collection
curl -s "$BASE_URL/collections/ghi11223-owasp-top-10" \
  -H "Authorization: Bearer $API_KEY" \
  | jq -r '.data.items[].content.slug' \
  | while read slug; do
    curl -s "$BASE_URL/rules/$slug" \
      -H "Authorization: Bearer $API_KEY" \
      | jq -r '"## " + .data.title + "\n" + .data.body + "\n"'
  done >> CLAUDE.md