Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Inline tiny critical SVGs and icons Find small, critical SVG icons and graphics that are loaded as separate network requests on important pages. Inline the few that appear above the fold directly into the markup or a sprite so they render without extra round trips, while keeping larger or rarely-used graphics external. Avoid inlining large SVGs that would bloat the HTML. Verify the critical icons appear instantly with fewer requests. 2.Use database connection pooling Check whether my app opens a fresh database connection per request or operation instead of reusing a pool. Configure a properly sized connection pool so connections are reused, with limits tuned to the database's capacity and the app's concurrency. In serverless or high-fan-out setups, ensure pooling works correctly (e.g., via a pooler). Verify connection overhead drops and the database isn't overwhelmed by connection churn under load. 3.Add an in-memory cache layer Identify frequently accessed, slow-to-fetch data that would benefit from a fast in-memory cache (such as Redis or an in-process cache for single instances). Introduce the cache layer for those reads with clear keys, TTLs, and a safe miss-and-populate path, falling back to the source on cache failure. Be mindful of consistency across multiple server instances. Verify the cached reads are dramatically faster and source-system load drops. 4.Add a client-side request cache Review how my client refetches data when users revisit screens or navigate back and forth, and find cases where it re-requests identical data unnecessarily. Introduce a client-side cache (or adopt a data-fetching library that provides one) keyed by request parameters, with sensible freshness and invalidation rules. Ensure mutations correctly invalidate affected cache entries. Verify revisiting screens reuses cached data and avoids redundant requests.

Copy and paste these prompts into Claude Code, Codex, Cursor, or any other coding agent. Run them one at a time, and test your app after each change. 1.Block operating system command injection Search the codebase for any place where the app runs operating-system commands, shell scripts, or external processes, and check whether user-controlled input can influence them. Eliminate command injection by avoiding the shell entirely where possible, passing arguments as a structured array rather than a concatenated string, and strictly validating any input that must be included. If a piece of functionality doesn't truly need to shell out, refactor it, and report every command-execution site you found. 2.Replace weak cryptographic algorithms Scan the codebase for weak or outdated cryptography and replace it. Find uses of broken hash functions like MD5 or SHA1, weak ciphers like DES, insecure modes like ECB, hardcoded encryption keys or initialization vectors, and homegrown crypto, and replace each with a current, well-vetted algorithm and a standard library implementation. Confirm that hashing for passwords specifically uses a slow algorithm, and report every weak primitive you found and what you replaced it with. 3.Verify signatures on incoming webhooks Audit any webhook endpoints my app exposes to receive events from third-party services. For each, verify the authenticity of incoming requests using the provider's signature mechanism — validating the signature against the raw request body with the shared secret and a constant-time comparison — and reject anything that fails. Add protection against replayed events using timestamps or event identifiers, and tell me which webhooks now verify their senders. 4.Cap request body and payload size Add limits on the size of incoming requests across my app. Configure maximum request body sizes at the server or framework level, cap the size of uploaded files and individual fields, and limit the number of items in arrays and the depth of nested JSON so a malicious payload can't exhaust memory or CPU. Return a clear error when a limit is exceeded, and tell me the limits you set and where they're enforced.

Would love to know your thoughts here!

Instagram Reels optimizes for video times that are too short for me to explain things in depth. I'm considering doing a couple long-form tutorials a week, and posting them to YouTube (and of course Skool by extension). What type of content would you want to see? A Q&A style where the video content is based on polls I run in this community? A series of building a product from absolute scratch with zero manual coding? Something else? Let me know!

They’re going with a very Anthropic-y naming convention now. Not sure how I feel about it lol