I Gave Claude Code an Empty Folder
Four questions, and the project was laid out. The folders were not the part worth keeping. The CLAUDE.md written during setup is what every later session reads instead of working the repository out again.
BLOG POSTS
A Tenancy Review Found One Customer Could Read Every Customer's Data
One endpoint returned every site's customer names and email addresses to any caller holding a valid key. The missing WHERE clause was the symptom. The cause was that every install shared one credential, so there was no identity to filter by.
The Picture That Could Not Be Drawn
An image prompt asked for a hundred tiles with three filled in, captioned as a tenth of a percent. The arithmetic didn't agree with itself, and no amount of re-rendering the same brief was ever going to fix that.
The Fix for One Security Finding Created the Next One
A rate limiter was keyed on the wrong address, so a prior fix switched it to a header Cloudflare sets. The header turned out to be forgeable by anyone who knew the origin's IP, because closing one gap opened a narrower one in its place.
The CLAUDE.md That Travels With Me, and the One That Doesn't
Two configuration files govern how Claude Code behaves on this project. One belongs to the person and follows them everywhere. The other belongs to this one repository and nowhere else. Mixing up which rule lives in which file is the actual failure mode worth naming.
The Skill File Is the New System Prompt
A skill is a markdown file, a name, and a one-line description. The description is the only part that decides whether the skill ever gets used. Get that one line wrong and the rest of the file might as well not exist.