01Plan
Plan before you ask
Before asking for execution, ask for analysis, an architecture proposal and a plan. Validating the direction first avoids redoing everything later.
Claude works much better when it understands the context, goal and constraints before executing. Setting the direction first saves rework.
Before asking for execution, ask for analysis, an architecture proposal and a plan. Validating the direction first avoids redoing everything later.
Turn on planning before important tasks. Claude thinks before acting and makes more deliberate decisions.
Instead of "create a dashboard", explain what it is for and who will use it. With a clear goal, Claude decides better.
Ask Claude to raise 3 important questions before executing. It reduces ambiguity and improves alignment.
A conversation's context is limited. People who record decisions and progress in files solve this and keep continuity across sessions.
Keep decisions, rules, architecture and progress in .md files. Claude rereads them and picks up where it left off.
Create a CLAUDE.md in each part of the project with standards, constraints and conventions. They become rules Claude always follows.
Before opening a new chat, ask for a technical summary with decisions, files and next steps. Continue without losing the thread.
A progress.md file with tasks, status, decisions and blockers gives you traceability and continuity.
Put rules, decisions and standards in one place. Every agent then uses the same source of truth.
If Claude keeps repeating solutions or insisting on mistakes, summarize the context and start a clean chat.
Split tasks and repeatable sequences give you more control and consistent results. It is the difference between chatting and operating.
Too many steps at once make the result worse. One decision, one feature, one validation at a time.
Ask Claude to create a checklist, execute it step by step and update the progress. More operational control.
Turn the sequences that work into repeatable processes: research, summarize, structure, validate, execute.
Stop treating Claude as a chat. Use it as memory, workflow and an operational copilot for your work.
Subagents, models and hooks pay off when used with judgment. Focus is worth more than the number of features switched on.
Delegate research, tests and documentation to separate agents. The main agent stays focused on execution.
Use stronger models to plan and reason, and fast models to execute. Better value for money.
Asking Claude to think harder helps with complex problems, but it uses more tokens. Use it with judgment.
For visual bugs and layout problems, send a screenshot. It is worth more than several paragraphs of explanation.
Connecting too many tools clutters the context. Keep only the ones you actually use day to day.
Set up hooks to run lint, tests and security checks before and after tasks, without having to ask.
It can invent solutions, add too much complexity or ignore edge cases. Reviewing the output is part of the process, not an optional step.
Check logic, security, performance and consistency before accepting the result. Nothing goes in without review.
After it executes, ask it to review and point out possible errors. It finds flaws it created itself.
Fragmented debugging is slow. Bring together frontend, backend, API and database logs so Claude finds the error fast.
Most breaches come from simple oversights: an exposed file, a secret in the wrong place. These tips cover the most common mistakes when publishing a site and when using AI day to day.
Passwords, keys and tokens live in the .env file. It must not go to the server: anyone with the link to the published folder can download any file in it.
Drafts, backups and reference material do not belong in the folder that goes to the server. Keep that content in a separate folder, for local use only.
A key that enters Git history stays there even after you delete it. Use .gitignore for the .env and sensitive files from the very first commit.
If a secret showed up in a screenshot, a public repository or a message, consider it compromised. Generating a new key is faster than measuring the damage.
HTTPS protects the data going back and forth between the visitor and the server. Today it is a basic requirement of any site, not a detail.
Forms and URL parameters are an entry point for attacks. Never trust what arrives from the browser without checking it first.
Claude can generate vulnerable code. Explicitly ask for protection against XSS, SQL injection and for access control.
Limit how often APIs can be called to prevent abuse, spam and overload. APIs without limits are an easy target.
Avoid sending passwords, customer data and keys to the AI. When you need an example, swap in fictional data.
Code that works is not secure code. Before deploying, read what was generated looking for gaps and exposed data.
AI can suggest libraries that are outdated, abandoned or that do not even exist. Check each dependency before installing it.
Now it becomes a habit. Repeat the systems you built, refine them with new hacks and keep an eye on what comes next.