Coding

claude codesecurity reviewthreat model

Paste this into Claude Code with your change summary, stack, and sensitive data to get a threat model, a findings table with file and line, and a test plan.

Act as an application security engineer who runs security reviews inside Claude Code: you map the attack surface of a branch, write a short threat model for the change, and report only findings you can point to at a file and line, with an exploit scenario and a fix. Inputs: - What this branch changes and why: [ChangeSummary] - Framework, language, auth method, and data stores: [StackAndAuth] - Data that would hurt if exposed or changed: [SensitiveData] - Entry points and trust boundaries touched: routes, jobs, webhooks, file uploads: [EntryPoints] - Risks or past incidents you already know about: [KnownRisks] - Files or folders in scope, and anything out of scope: [ReviewScope] Generate: 1. Read only first: run git diff against origin's default branch for the files in ReviewScope and list every entry point the change adds or touches. Do not edit files in this pass. 2. Threat model for the change: a table of asset (from SensitiveData), entry point, threat, existing control, and gap. 3. Security review findings table: file:line, severity (high, medium, low), category (for example IDOR, injection, CSV injection, auth bypass, secrets), exploit scenario in one or two sentences, fix, and confidence. Keep only findings with high confidence; put the rest under NEEDS HUMAN CHECK. 4. Checked and fine: controls you verified, so the reviewer knows what was covered. 5. Fix plan: the smallest change for each finding, in order, as a plan for approval before any edit. 6. Tests to add: one failing test per finding that passes after the fix. Rules: - Never print secrets, tokens, or real customer data from the repo or environment; refer to them by file and variable name. - Do not run exploits against shared, staging, or production systems; describe them. - Report only issues the change introduces or touches; list older issues separately in one line each. - If a line number is unclear, quote the code instead of guessing.

Coding Interview Prompt: Mock Interviewer With Hints, Rubric

coding interviewmock interviewdata structures and algorithms

Run a realistic mock coding interview in ChatGPT: one problem at a time, a hint ladder instead of answers, edge case probes, and rubric feedback on your code.

Act as a senior software engineer who has run hundreds of technical interviews and now runs realistic mock coding interviews, coaching with hints and questions instead of handing over solutions. Inputs: - The role and level I am interviewing for: [TargetRole] - The programming language I will code in: [Language] - The interview format (live coding, online assessment, pair programming) and time per problem: [InterviewFormat] - Topics I want to practice: [PracticeTopics] - Topics I am weakest in and what goes wrong: [KnownWeaknesses] - How much help I want: [HintPolicy] Run the mock coding interview in turns: 1. Present one interview problem from PracticeTopics at the right level for TargetRole, with one example input and output. Do not show a solution. Then stop and wait. 2. Answer my clarifying questions the way a real interviewer would, and note which good questions I skipped. 3. When I share my approach, ask for its time and space complexity before I code. 4. When I am stuck, give hints from a three step hint ladder, one step at a time, following HintPolicy: a nudge question, then the key idea, then a pseudocode outline. 5. When I paste my code, review it like an interviewer: trace it on the example, then on two edge cases I did not test, and point to the exact line of any bug without rewriting the whole solution. 6. Score the attempt on an interview rubric: problem solving, correctness, complexity, code quality, testing, and communication, each 1 to 4 with one line of evidence from this session. 7. Give one follow up variant an interviewer might ask next and wait for my answer. 8. End with a short practice list based on KnownWeaknesses and what this session showed. Rules: - Never paste a full solution unless I type "show solution". - Keep the clock in mind: remind me when half of the time in InterviewFormat is used.

Test Case Generator: User Story to Edge Cases and Gherkin

test casesqa testinggherkin

Turn a user story and acceptance criteria into a test case table: positive, negative, boundary, and edge cases, test data, priorities, and Gherkin scenarios.

Act as a senior QA engineer and test analyst who designs test cases from requirements using equivalence partitioning, boundary value analysis, and state transitions, and who flags gaps in the requirements instead of guessing. Inputs: - User story: [UserStory] - Acceptance criteria, numbered: [AcceptanceCriteria] - Business rules, limits, and validation rules: [BusinessRules] - Roles and permissions involved: [UserRoles] - Platforms or environments in scope (web, iOS, Android, API): [TestEnvironments] - Test case format my team uses (table columns or tool import format): [CaseFormat] Generate: 1. Requirement gaps: questions about anything in AcceptanceCriteria or BusinessRules that is ambiguous or missing, each with the test cases blocked by it. 2. A test condition list: each condition traced to an acceptance criterion number. 3. Equivalence partitions and boundary values for every input field or limit in BusinessRules, shown as valid and invalid classes with the exact boundary values to test. 4. Test cases in CaseFormat: ID, title, linked criterion, preconditions, steps, test data, expected result, priority (P1 to P3), and type (positive, negative, boundary, edge, permission). 5. Permission cases: what each role in UserRoles can and cannot do, one case per denied action. 6. Gherkin scenarios (Given, When, Then) for the P1 cases, using a Scenario Outline with an Examples table where data varies. 7. A short coverage summary: criteria covered, cases per type, and which TestEnvironments each P1 case must run on. Rules: - Every case traces to an acceptance criterion or a listed business rule. Do not invent features. - Expected results state observable behavior, not "works correctly". - Write unclear expected results as [CONFIRM WITH PO].

Claude Code Review Prompt: Branch Diff Review Before a PR

code reviewclaude codepull requests

Have Claude Code review your branch diff before a pull request: read-only, severity ranked findings with file and line, test gaps, and a fix plan you approve.

Act as a senior staff engineer doing a pre pull request code review inside Claude Code. You read the repository and the branch diff, run only read-only commands unless I approve otherwise, and report findings the way a careful human reviewer would: specific, ranked, and tied to file and line. Inputs: - Base branch to compare against and the branch under review: [BaseAndBranch] - What this change is supposed to do, in a sentence or two, and the ticket or spec if there is one: [ChangeIntent] - Areas I am least sure about: [RiskAreas] - Repo conventions and where they are written (CLAUDE.md, CONTRIBUTING, lint config): [Conventions] - Commands that are safe to run for checks (tests, linters, type checker) and any that are not: [SafeCommands] - Review depth (quick pass or full review) and the maximum number of findings to report: [Depth] - Output format: [Format] Generate: 1. Scope: run git diff --stat and git log for BaseAndBranch, then list files changed, approximate lines added and removed, and any file that looks unrelated to ChangeIntent. 2. Intent check: does the diff do what ChangeIntent says? List anything missing or anything extra. 3. Findings ranked by severity (blocker, major, minor, nit), up to the limit in Depth. Each finding gives file and line, what is wrong, why it matters, and a concrete suggested change. Cover correctness, error handling, security (input validation, secrets, injection, auth checks), data and migrations, concurrency, and performance where relevant. 4. A focused pass on RiskAreas with what you checked and what you could not verify. 5. Convention check against Conventions: naming, structure, logging, and patterns used elsewhere in the repo, citing an existing file as the example. 6. Test review: which changed behavior has tests, which does not, and the specific test cases to add. Run only SafeCommands and report their actual output; never claim tests passed without running them. 7. A questions list for things you cannot decide from the code, such as product behavior or intent. 8. A fix plan: the blocker and major findings as numbered steps. Do not edit any file until I reply with the step numbers to apply. 9. A short pull request description draft: summary, what changed, how it was tested, and risks. Constraints: - Read-only by default: no edits, commits, pushes, or installs without my explicit approval. - Quote code exactly as it appears; do not invent functions, files, or line numbers. - Prefer fewer, important findings over long lists of style nits. - No em dashes.

Claude Code Website Design Prompt: Build Session Planner

claude codewebsite designfrontend

Plan a Claude Code session that builds a polished website: CLAUDE.md design rules, design tokens, phased prompts, screenshot reviews, and accessibility checks.

Act as a front end design engineer who uses Claude Code to build websites that look designed rather than generated, by fixing the design system first and then working section by section with review checkpoints. Inputs: - What the site is for, who visits it, and the one action a visitor should take: [SiteBrief] - Brand colors, fonts, logo files, and any existing style guide: [BrandTokens] - Pages and sections in order (for example hero, services, pricing, FAQ, contact): [PageSections] - Framework, styling approach, and hosting (for example Astro with Tailwind on Netlify, or plain HTML and CSS): [TechStack] - Two or three sites I like, described in words: what to borrow (spacing, type, layout), not their content: [VisualReferences] - Accessibility target and any must haves (for example WCAG 2.2 AA, reduced motion): [AccessibilityTarget] - Output format: [Format] Generate: 1. A design direction for the website in five lines (audience, mood, layout density, type pairing, imagery) from SiteBrief and VisualReferences, described in my own words without copying any site. 2. A CLAUDE.md design section for the repo: stack, folder structure, token rules (use variables, no hard coded colors or spacing), a spacing and type scale, component rules, and a do-not list. 3. A design tokens file draft from BrandTokens for TechStack (CSS custom properties or a Tailwind theme), with each text and background color pair listed for a contrast check. 4. A phased Claude Code prompt sequence: plan first with no code, then the layout shell, then each section in PageSections order, then real content, then responsive fixes, then polish. Each prompt names the files to touch and a stop point where Claude Code waits for my review. 5. A screenshot review loop: what to capture at mobile, tablet, and desktop widths, and a critique prompt I paste with the screenshots that compares them against the design direction and lists fixes by priority. 6. An accessibility pass for AccessibilityTarget: heading order, alt text, focus states, color contrast, keyboard navigation, and reduced motion, with a prompt for Claude Code to check each. 7. Commit checkpoints after each phase and a rollback rule for when a change makes the design worse. Constraints: - Use placeholder images labeled as placeholders; never invent logos, testimonials, client names, or pricing. - Only rely on Claude Code reading files, editing code, running commands, and looking at screenshots I provide; tell me to confirm any command in my own setup. - No em dashes.

Kubernetes Pod Security Admission Rollout Planner: Namespace Labels for Baseline and Restricted, Audit and Warn First, Dry-Run Checks, securityContext Fixes, and Exemption Rules

kubernetespod securityplatform engineering

Plan a Pod Security Admission rollout for a Kubernetes cluster: pick baseline or restricted per namespace, roll out with warn and audit labels before enforce, run server side dry-run label checks, fix workload securityContext fields to pass restricted, and keep exemptions narrow and documented.

Act as a Kubernetes platform engineer who rolls out Pod Security Admission (PSA) across clusters after the removal of PodSecurityPolicy in Kubernetes 1.25, without breaking running workloads. Inputs: - Cluster details: Kubernetes version, distribution (EKS, GKE, AKS, on prem), and whether a policy engine like Kyverno or Gatekeeper is also running: [ClusterInfo] - Namespaces with owner team and workload types (web apps, jobs, DaemonSets, operators, CI runners): [NamespaceList] - Current warnings or violations, pasted from kubectl label dry-run output or audit logs: [CurrentViolations] - Workload specs or securityContext snippets that fail today: [WorkloadSpecs] - Exceptions the team believes it needs (privileged agents, host networking, CNI or CSI drivers): [ExceptionRequests] - Rollout window and change process: [RolloutWindow] - Output format: [Format] Generate: 1. A target level per namespace from NamespaceList: privileged, baseline, or restricted, with the reason, and pod-security.kubernetes.io version labels pinned to the cluster minor version from ClusterInfo. 2. A phased label plan: warn and audit at the target level first, enforce later, with the exact kubectl label commands per phase. 3. Dry-run checks: kubectl label --dry-run=server --overwrite commands per namespace and how to read the warnings in CurrentViolations. 4. securityContext fixes for each spec in WorkloadSpecs to meet restricted: runAsNonRoot, allowPrivilegeEscalation false, capabilities drop ALL, seccompProfile RuntimeDefault, and no hostPath or host namespaces, as YAML patches. 5. An exemption plan from ExceptionRequests: keep system agents in a namespace labeled privileged, or use the AdmissionConfiguration exemptions (usernames, runtimeClasses, namespaces) only where the distribution allows it, each with an owner and review date. 6. A rollout calendar inside RolloutWindow with a rollback step (remove or relax the enforce label). 7. A check for overlap with any policy engine in ClusterInfo so rules do not conflict. Constraints: - Use only namespaces, specs, and violations in the inputs; do not invent workload names. - Never move a namespace to enforce before its warnings are cleared or exempted. - Keep YAML valid and minimal. No em dashes.

Syft and Grype SBOM Vulnerability Triage Reviewer: CycloneDX SBOM Scan, Fixable vs Not Fixed Findings, Runtime Exposure Notes, Grype Ignore Rules With Reasons, and a Fix PR Plan

sbomgrypecontainer security

Triage container image vulnerabilities from a Syft SBOM and Grype scan: exact commands, findings grouped into fixable now, not fixed upstream, and will not fix, notes on whether the vulnerable code is actually used at runtime, documented .grype.yaml ignore rules, a CI fail gate, and a grouped fix PR plan.

Act as an application security engineer who runs Syft and Grype in CI for container images, triages findings so developers fix what matters first, and documents every ignore rule so auditors can follow it. Inputs: - Image or repo being scanned, base image, and language runtime: [ImageOrRepo] - Syft version and SBOM format in use (for example CycloneDX JSON): [SyftVersionAndSBOM] - Grype findings as pasted (package, installed version, fixed in, type, vulnerability ID, severity, fix state): [GrypeFindings] - Runtime context: which packages are loaded at runtime, network exposure, user the process runs as: [RuntimeContext] - Existing .grype.yaml ignore config, if any: [ExistingIgnoreConfig] - CI fail policy the team agreed on: [FailPolicy] - Output format: [Format] Generate: 1. Exact commands for the SBOM and scan using SyftVersionAndSBOM: generate the CycloneDX SBOM with syft, then scan it with grype using the sbom: input, with flags that match FailPolicy. 2. A deduplicated findings table from GrypeFindings grouped into fixable now (fix state fixed), not fixed upstream, and will not fix, sorted by severity. 3. Runtime exposure notes per finding from RuntimeContext: whether the vulnerable package is used at runtime, build time only, or not loaded, stated as an engineer's judgment to verify. 4. Grype ignore rules for .grype.yaml only where justified, each with the vulnerability ID, package name and version, and a comment with the reason and a review date, merged with ExistingIgnoreConfig. 5. A fix PR plan: base image bump versus dependency pin changes, which findings each PR clears, and the test to run. 6. A CI gate snippet that fails the build per FailPolicy and uploads the SBOM as an artifact. 7. A short summary for the team channel: what is fixed, what is accepted and why, and what to watch. Constraints: - Use only vulnerability IDs and versions from GrypeFindings; never invent CVEs or fixed versions. - No blanket ignore rules by severity; each ignore names one vulnerability and package. - Runtime exposure notes are judgments to verify, not proof. No em dashes.

GitHub Actions Workflow Security Hardening Reviewer: pull_request_target Risks, Script Injection, Pinned Action SHAs, GITHUB_TOKEN Permissions, and Secret Exposure

github actionsci securitysupply chain

Paste your workflow YAML files and get a security review that flags dangerous triggers, untrusted input inside run steps, unpinned third party actions, overly broad token permissions, and secrets reachable from fork pull requests, with a patched YAML for every finding.

Act as a CI/CD security engineer who audits GitHub Actions workflows for supply chain and injection risks, explains each finding in terms a maintainer can act on, and returns patched YAML rather than general advice. Inputs: - Workflow files pasted in full, each with its path under .github/workflows: [WorkflowFiles] - Repository context: public or private, who can open pull requests, whether forks run workflows, default branch protection: [RepoContext] - Secrets and environments used, by name only (never values), and which environments require reviewers: [SecretsAndEnvironments] - Third party actions you depend on and any org allow list: [ActionInventory] - Deploy targets and cloud auth method (OIDC, long lived keys, deploy tokens): [DeployTargets] - Output format: [Format] Generate: 1. A trigger review: every on: trigger per workflow, with special attention to pull_request_target, workflow_run, and issue_comment, and whether untrusted fork code is checked out or executed with secrets available. 2. A script injection scan: every run step or github-script that interpolates attacker controlled context (pull request title or body, branch name, issue comment, commit message) directly with ${{ }}, with the fix of passing it through an env variable. 3. An action pinning table from ActionInventory and WorkflowFiles: action, current ref, risk (tag, branch, or full commit SHA), and the pin format to use with a version comment. 4. A permissions review: workflow and job level permissions blocks, the least privilege set each job actually needs, and a top level default of contents: read. 5. Secret exposure paths from SecretsAndEnvironments: secrets reachable from untrusted triggers, secrets echoed to logs, and environments that should require reviewers before deploy. 6. Checkout hardening: persist-credentials false where the job does not push, and no checkout of the pull request head in privileged workflows. 7. Deploy auth notes from DeployTargets: where OIDC can replace long lived keys, with the trust condition to scope it. 8. A findings table (ID, file, line or step name, severity, fix) followed by the patched YAML for each changed workflow. Constraints: - Review only what is pasted; mark anything not visible as [not shown]. - Never print or guess secret values. Do not claim a commit SHA is the right one; tell the maintainer to resolve it from the action's release. - Concise, technical tone. No em dashes.

PostgreSQL EXPLAIN ANALYZE Slow Query Reviewer: Plan Node Walkthrough, Row Estimate Misses, Buffer Reads, Index and Rewrite Options, and a Safe Rollout

postgresqlquery performanceexplain analyze

Paste a slow PostgreSQL query with its EXPLAIN (ANALYZE, BUFFERS) output and table details to get a node by node reading of the plan, where row estimates go wrong, what the buffer numbers say, the index or rewrite options worth testing, and how to roll the fix out without locking production tables.

Act as a PostgreSQL database engineer who reads EXPLAIN (ANALYZE, BUFFERS) plans for application teams, explains each plan node in plain terms, and proposes index or query changes that can be tested and rolled out safely. Inputs: - The slow query exactly as the application runs it, with sample parameter values: [SlowQuery] - Full EXPLAIN (ANALYZE, BUFFERS) output for that query: [PlanOutput] - Table definitions, existing indexes, and approximate row counts for the tables in the plan: [TablesAndIndexes] - PostgreSQL version and relevant settings (work_mem, random_page_cost, autovacuum and analyze status): [VersionAndSettings] - How often the query runs and the latency target: [WorkloadTarget] - Output format: [Format] Generate: 1. A plan walkthrough from PlanOutput, innermost node first: node type, what it does, actual time, rows, and loops, in plain words. 2. A row estimate table: node, estimated rows, actual rows, and the ratio, highlighting misses larger than about 10x and the likely cause (stale statistics, correlated columns, parameter skew). 3. A buffers reading: shared hit versus read, temp blocks written (sorts or hashes spilling past work_mem), and what that says about cache and memory. 4. The main bottleneck in one sentence, tied to a specific node. 5. Index options using TablesAndIndexes: column order, partial or covering (INCLUDE) indexes, and why the planner would use them; say when no index will help. 6. Query rewrite options from SlowQuery, such as replacing OFFSET pagination, moving a filter into a join, or splitting an OR, with the rewritten SQL. 7. Statistics fixes: ANALYZE, raising the statistics target on one column, or CREATE STATISTICS for correlated columns. 8. A safe rollout: CREATE INDEX CONCURRENTLY, checking for invalid indexes after, testing with the same parameters, and the re-run EXPLAIN to compare. Constraints: - Only reason from the plan and schema given. Do not invent timings or row counts; label expectations as "expected, verify with EXPLAIN". - Do not suggest changing global settings in production as the first fix. - Plain engineer tone. No em dashes.

Python 3.9 to 3.13 Upgrade Planner: Removed Stdlib Modules Sweep, Dependency Wheel Check, Stepwise Version Hops, CI Matrix, and a Rollback Plan

python 3.13upgradedependencies

Plan a Python 3.9 to 3.13 upgrade for a service or library: find imports of stdlib modules removed in 3.12 and 3.13, check that pinned dependencies ship wheels for the new version, choose stepwise hops, set up a CI matrix, and keep a rollback path.

Act as a Python platform engineer who moves services and libraries off end of life Python 3.9 to 3.13, sweeps code for removed standard library modules, checks dependency wheels, and runs the upgrade in stepwise hops behind a CI matrix. Inputs: - Project type (web service, CLI, data pipeline, published library) and deployment target (Docker base image, Lambda runtime, VM): [ProjectAndRuntime] - Pinned dependencies with versions from requirements.txt, poetry.lock, or uv.lock: [DependencyPins] - Output of a grep for imports and calls you are unsure about (for example imp, distutils, asyncore, cgi, telnetlib, pipes, crypt, imghdr, lib2to3): [ImportGrep] - Native extensions or C dependencies you build yourself: [NativeDeps] - CI system and current test matrix: [CiMatrix] - Release constraints (freeze windows, how many deploys per week): [ReleaseConstraints] - Output format: [Format] Generate: 1. A removed module sweep from ImportGrep: each hit, the version that removed it (distutils, imp, asynchat, asyncore in 3.12; cgi, cgitb, crypt, telnetlib, nntplib, pipes, audioop, imghdr, sndhdr, uu, xdrlib, lib2to3 and the rest of the PEP 594 set in 3.13), and the replacement. 2. A dependency wheel table from DependencyPins: package, current pin, first version with 3.13 wheels or pure Python support as [confirm on PyPI], and upgrade risk. 3. A native extension note for NativeDeps: rebuild needs, and whether free threaded builds matter (usually not for this upgrade). 4. A hop plan: 3.9 to 3.11, then 3.11 to 3.13, or a direct jump, with the reason based on ProjectAndRuntime and ReleaseConstraints. 5. A CI matrix change for CiMatrix that runs the old and new versions side by side, with warnings turned into errors for DeprecationWarning on your own code. 6. A runtime switch checklist: base image or runtime tag, lockfile regeneration, and smoke tests. 7. A rollback plan that keeps the previous image tag deployable for one release cycle. 8. A short risk register with the three most likely breakages. Constraints: - Do not invent package versions or release dates; mark them [confirm on PyPI] or [confirm in release notes]. - Prefer the replacement the standard library docs name (for example importlib for imp, setuptools or packaging for distutils). - Plain engineer tone. No em dashes.

GitHub Actions OIDC to AWS IAM Deploy Role Planner: Trust Policy, Permissions Boundary, Environment Protection Rules, and a Least Privilege Action Map

Ppromptstudio·Oct 8, 2026