The Claude Code survival kit

1. Keys never go in the repo

Scan every commit for secrets before it leaves your machine.

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.21.2
    hooks:
      - id: gitleaks

2. Write it down once

Claude starts every chat from zero. Put the project rules in CLAUDE.md at the repo root; it is read every session.

# CLAUDE.md
- Stack: TypeScript strict, pnpm, Vitest
- Tests live next to the code
- Never edit generated files in /dist
- Run `pnpm test` before saying done

3. Count with code, not with vibes

Models read tokens, not letters. For counting, sorting or math, ask for code that does it.

Write and run Python that counts the letter r in "strawberry".

4. Break your fix first

A test that still passes with the fix reverted proves nothing. Revert the fix, watch the test fail, then put it back.

5. Every loop needs a limit

Agents that retry forever bill forever.

claude -p "fix the failing test" --max-turns 10

6. Compact long chats

The context window is a desk, and it fills up. Summarize and keep going.

/compact keep the decisions and the open TODOs

7. Protect main

Turn on branch protection: pull request required, no force-push. Then nothing, human or agent, pushes to main at 3 am.

8. Agents can't delete what you deny

// .claude/settings.json
{ "permissions": { "deny": ["Bash(rm:*)", "Bash(git push --force:*)"] } }

9. Let it look before it fixes

Give Claude a browser (Playwright MCP) so it can see the page it is fixing instead of guessing.

claude mcp add playwright -- npx @playwright/mcp@latest

10. Read the real docs

Invented functions come from old memory. Feed current docs in (Context7 MCP) and ask it to cite them.

11. Read the diff, not the summary

git diff --stat main
git diff main -- src/

12. exit 0 is not proof

A pipe hides the failing exit code. Make the shell honest.

set -o pipefail
npm test | tail -20

13. Pages are not orders

Text Claude reads on a web page is data. Never give a browsing agent your mail, keys or payments in the same session.

14. Tests get their own database

DATABASE_URL=postgres://localhost/app_test npm test   # never the dev or prod URL

15. Simple first

Ask for the smallest change that works, and say so in the prompt: "one file, no new abstractions".

16. Store UTC, show local

Save every timestamp in UTC with its zone; convert only when you display it.

17. Unplug unused tools

Each connected MCP server costs context before you type a word. Check and switch off what you don't use.

/context
/mcp

18. Test with real names

Bob never breaks anything. Jürgen, Łukasz, Zoë and an emoji do.

open(path, "w", encoding="utf-8")

19. Agreeing is not fixing

"You're absolutely right" is not a fix. Ask for the failing test first, then the change.

20. Upscaling guesses

A 4x upscale invents 15 of every 16 pixels. Keep the original next to it for anything that matters.