Understand unfamiliar code
Start here in any new project. Ask for the map before you ask for changes.
Show prompt
Try this
Explain what this code does and how the pieces connect: [paste or point to it]. Then tell me which part to read first.
Build with AI · Guide 5 of 10
Code with AI
Build faster, understand what you build, and review all of it.
What it is great for
Write a first pass of a small feature
Programmers with GitHub Copilot finished one server task 55.8% faster in a trial co-written by GitHub staff.
Show prompt
Try this
Add [feature] to this project. Plan it first, keep the change small, follow the existing style, and tell me how to test it.
Write the tests
A test gives you and the tool a clear pass or fail, which the Claude Code docs recommend so it can work and check itself.
Show prompt
Try this
Write tests for this function: [paste]. Cover normal input, empty input and bad input. Do not change the function.
Learn while you build
In one small trial, people who asked conceptual and follow-up questions scored higher than those who delegated. That pattern is correlational.
Show prompt
Try this
Before you write this, explain the approach and why. Then ask me to write the first part myself, and review what I wrote.
Set up before you code
A workflow that saves rework, with Claude Code as the example
Choose the stack before the first prompt
Decide the framework, language, versions and where it will be hosted, and write them down. Left open, the AI picks for you and can change its mind halfway.
Put the stack at the top of CLAUDE.md, so every session starts from the same choices.
## StackAstro 7, strict TypeScript, Tailwind 4.Node 22+. Hosted on Cloudflare Pages.# settled once, read every sessionWrite CLAUDE.md before you write code
List the commands, where things live and the rules that never change. Keep it short and specific.
/init drafts a first version from your project. Add the commands it must run and what "done" means.
## Commandsnpm run dev local servernpm run check must pass## RulesNever invent facts. Unknown means TODO.Define everything in plan mode
Agree the goal, the pages or features, the data and what finished looks like before any file changes. Changes are cheap in a plan and expensive in code.
Shift+Tab switches to plan mode, where it reads and explores but does not edit source files. Let it question you, correct the plan, then approve it.
Show prompt
Try this
Before any code: interview me about this feature one question at a time. Cover the goal, who uses it, the data, edge cases and how we will know it is done. Then write the plan as numbered steps with the files each one touches, and wait for my approval.
Shift+Tab plan modeInterview me, then write the plan.# read it, correct it, approve it# only then does it start editingTurn repeat jobs into workflows
Write each job you repeat as a short step-by-step file, and give the fiddly steps a script. If each step is 90% reliable, five in a row is only about 59%, so scripts beat retyping.
Keep the steps in a workflows/ folder and the scripts in tools/, and tell CLAUDE.md to read the matching workflow first. A skill does the same job inside Claude Code.
├─ CLAUDE.md read workflows/ first├─ workflows/│ ├─ add-page.md│ └─ pre-ship.md└─ tools/ ├─ check.sh └─ screenshot.mjsGive it a check it can run
Before the first feature, add one command that fails when something is broken. The AI can then test its own work instead of telling you it is done.
Ask for the command it ran and its output as evidence, not a summary.
npm run check# 0 errors before anything is called doneHow to do it
Plan the change
Agree the approach before any code is written.
5 Give it a pass or fail check
Tests or a build let the tool see its own mistakes.
2 Read every change
Review it like a stranger's pull request, especially input handling.
7 Check you can explain it
If you could not explain it to someone else, ask until you can.
Where to be careful
AI code can be insecure
Models added a flaw of an OWASP Top 10 class in 45% of cases in a vendor benchmark. That does not mean 45% of real AI code is vulnerable.
7 Speed gains are not settled
One trial measured a slowdown, and METR calls its later data "only very weak evidence" for the size of any speedup.
8 9 It magnifies your habits
DORA calls AI "an amplifier" of existing strengths and weaknesses, so get testing and review in place first.
10
Behind this guide
Notes, evidence and sources
Why we say this
5 sources, each with its catch.
Peng et al., with GitHub staff · February 2023
Copilot users finished 55.8% faster
Programmers with GitHub Copilot finished one JavaScript server task 55.8% faster than a control group.
Authors include GitHub and Microsoft staff, it is one task, and code quality was not studied.
Full detail
In a randomised experiment (Peng et al., February 2023), professional programmers recruited through Upwork, using GitHub Copilot, finished an HTTP server task in JavaScript 55.8% faster than a control group (95% confidence interval 21 to 89%). 95 were recruited and 35 from both groups completed it. Less experienced developers benefited more.
Authors include GitHub and Microsoft Research staff, and both sell Copilot. It is one standard task, and the authors say it "does not examine the effects of AI on code quality".
Strength: Moderate
Veracode · 30 July 2025
Models added flaws in 45% of tests
Models introduced a flaw of an OWASP Top 10 class in 45% of cases in a synthetic benchmark.
Veracode sells code-scanning tools. This does not show 45% of real AI code is vulnerable.
Full detail
The Veracode 2025 GenAI Code Security Report (30 July 2025) tested 100+ language models on 80 coding tasks built from known weakness types (CWEs). In 45% of cases the models introduced a flaw of an OWASP Top 10 class. Java failed in over 70% of cases, Python, C# and JavaScript between 38% and 45%, cross-site scripting (CWE-80) in 86% and log injection (CWE-117) in 88%. The report says models are "getting better at coding accurately but are not improving at security".
Veracode sells code-scanning and fixing tools. This is a synthetic benchmark in which a secure and an insecure option both existed. It does not show that 45% of real AI-written code is vulnerable, although some outlets state it that way.
Strength: Moderate
METR · 24 February 2026
Later speed gains remain unproven
Later data pointed to about 18% less time for returning developers and 4% for new ones, but the confidence intervals include zero.
METR calls its data "only very weak evidence" for the size of the speedup.
Full detail
METR's update of 24 February 2026 used late-2025 data. Returning developers showed about 18% less time with AI and new developers about 4% less, but the confidence intervals include zero. METR says its data is "only very weak evidence" for the size of the increase: many developers refused to work without AI or withheld tasks, and self-reported speedups are unreliable. The experiment is being redesigned.
Its value is showing how hard the measurement is. Secondary blogs report this update in conflicting ways, so this guide uses only METR's own page.
Strength: Moderate to weak
DORA
AI amplifies strengths and weaknesses
DORA describes AI as "an amplifier" of an organisation's existing strengths and weaknesses.
A correlational survey from a Google-run programme. Only this quote was confirmed.
Full detail
The DORA 2025 report describes AI's primary role as "an amplifier, magnifying an organization's existing strengths and weaknesses." A Google blog summary reportedly adds that adoption is linked to higher throughput but also to instability unless testing and quality assurance keep pace.
Large survey, correlational, from a Google-run research programme. Only the quoted sentence was confirmed on the page; the throughput and instability point rests on a search summary. Exact numbers are deliberately not given.
Strength: Moderate
Stack Overflow survey
Many use it daily, fewer trust it
47.1% of respondents use AI daily, but 46% distrust its accuracy against 33% who trust it.
A self-selected survey of attitudes, not outcomes.
Full detail
The Stack Overflow Developer Survey 2025 reports that 47.1% of all respondents (50.6% of professionals) use AI tools daily. 46% distrust the accuracy of AI output against 33% who trust it, and 3.1% highly trust it. The top frustration, at 66%, is "AI solutions that are almost right, but not quite".
A large, self-selected, self-reported survey. It measures attitudes, not outcomes. Fieldwork dates are not on the page.
Strength: Moderate
Terms used in this guide
- Synthetic benchmark
- A standard test built for measuring, not real work.
- OWASP Top 10
- A well-known list of common web security risks. It is separate from OWASP's list for AI apps.
- Mature repository
- A long-running code project the developer already knows well.
All 11 sources for this guide
1. Peng et al. · February 2023
2. Claude Code docs: best practices · Checked 1 November 2026
3. Anthropic's trial on learning a library · 29 January 2026
4. Claude Code docs: CLAUDE.md · Checked 1 November 2026
5. Claude Code docs: plan mode · Checked 1 November 2026
Claude Code permissions page · costs page · best practices page
6. Claude Code docs: skills · Checked 1 November 2026
7. Veracode 2025 GenAI Code Security Report · 30 July 2025
8. METR's 2025 randomized trial · 10 July 2025
9. METR's February 2026 update · 24 February 2026
10. DORA 2025 report
11. Stack Overflow Developer Survey 2025