20 prompts
Do a security review of this codebase: authentication and session handling, authorisation checks on every endpoint (can user A read user B's data?), input validation, SQL and command injection, XSS, CSRF, file uploads, SSRF, secrets in code, and dependency vulnerabilities. Rank findings by severity with the exact file and line, and fix the clear-cut ones in a branch.
RepoScan the repo and its full git history for committed secrets: API keys, tokens, passwords, private keys and connection strings. List each with the file, commit and whether it looks live. Do not print full secret values. Recommend which to rotate and add a pre-commit secret scanner.
RepoRun the package manager's audit and check for known vulnerabilities in dependencies. Upgrade to patched versions where safe, verify the build and tests, and explain any vulnerability that does not affect us and why. Add automated dependency updates if not set up.
RepoList every endpoint and server action that reads or changes data. Write tests that check a logged-out user, a user from another account, and a user without the right role are all refused. Fix any endpoint that fails.
RepoCheck and add security headers: Content-Security-Policy (start in report-only), Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and frame-ancestors. Make sure nothing on the site breaks, and document the policy.
RepoFind endpoints that could be abused: login, sign-up, password reset, contact forms, expensive API calls, anything that sends email or costs money (like AI calls). Add rate limiting and basic abuse protection using what the stack already supports. Document the limits.
RepoAnalyse the JavaScript bundles. Find the biggest dependencies and code that ships to the client unnecessarily. Replace heavy libraries with lighter ones or native APIs, lazy-load routes and heavy components, and remove unused code. Report the size before and after for each main page.
RepoWrite a load test (k6, autocannon or similar) for our main API endpoints and pages against a local or staging environment only. Ramp up traffic, find where response times degrade and what breaks first, and suggest fixes. Never point it at production.
RepoReview what is cached and what is not: HTTP cache headers, CDN, static generation, server-side caches, and database query caching. Find expensive repeated work that could be cached safely, implement the clear wins, and document invalidation for each.
RepoFind out how our data is backed up from the infra config and docs. Write a runbook for restoring from backup, and a script to test a restore into a scratch database. Flag any data that is not backed up at all.
RepoMap every piece of personal data we collect, where it is stored, who can access it, which third parties receive it, and how long we keep it. Check the privacy policy matches reality. Find what we collect but do not need. Save to docs/data-map.md and fix the clear issues.
RepoList every cookie, local storage key, analytics tag and third-party script. Check whether a consent banner is legally needed for our audience, and if so implement one that blocks non-essential scripts until consent. Keep it simple and fast.
Repo WebWrite runbooks for the 8 most likely incidents for this app: site down, database full, payment failures, email not sending, third-party API outage, a leaked key, a bad deploy, and a traffic spike. Each with how to detect, diagnose, fix and communicate. Save to docs/runbooks/.
RepoAdd a health check endpoint that checks the app and its key dependencies. Write the config for uptime monitoring and alerts for error rate and latency with whatever tools we already use, and document who gets alerted and how.
RepoFind every image, font and video in the repo. Convert images to modern formats at sensible sizes, add responsive srcset, subset fonts, self-host where it helps, and lazy-load below the fold. Report bytes saved.
RepoAdd timing around API handlers in a local run, seed realistic data volumes, and find the slowest 10 endpoints. Profile each, fix the causes (queries, serial awaits, heavy computation), and report before and after timings.
RepoRead our infra config, deployment files and any usage data in the repo. List what we pay for and estimate where money is wasted: oversized instances, unused resources, chatty logging, missing caching, expensive API calls including AI. Propose savings with estimated amounts. Save to docs/cost-review.md.
RepoWrite a disaster recovery plan: what our recovery time and data loss targets should be, what we would do if our main region or provider went down, and a step-by-step drill to test it once a quarter. Save to docs/disaster-recovery.md.
RepoRun axe or Lighthouse accessibility checks on every page and audit by hand: keyboard navigation, focus order, labels, contrast, alt text, ARIA misuse and screen reader announcements. Fix what you can and write docs/accessibility.md listing remaining issues by WCAG criterion.
Repo BrowserWrite a threat model for this application: assets, entry points, trust boundaries, and the top 15 threats using STRIDE, each with likelihood, impact and current mitigations. Recommend the 5 most valuable fixes. Save to docs/threat-model.md.
Repo
How to run these while you sleep
- Open your project and start a fresh branch or git worktree, so the whole night is one diff you can review or delete.
- Add your product context above and keep overnight mode on. Claude will log its assumptions instead of waiting for answers.
- Paste one prompt into Claude Code, or save a few to a
queue/folder and loop over them headless. - In the morning, read the files it wrote and the diff. Merge what is good and send what needs sending yourself.
Want it off your laptop? Claude Code on the web runs each session in a cloud sandbox, so you can start a few before bed and close the lid.
Queue a night of prompts
git switch -c overnight/$(date +%F)
mkdir -p logs
for f in queue/*.md; do
claude -p "$(cat "$f")" \
--permission-mode acceptEdits \
--allowedTools "WebSearch" "WebFetch" "Bash(npm run *)" \
> "logs/$(basename "$f" .md).log"
doneOnly allow the tools a task needs. Browser prompts also need a browser MCP server such as Playwright; find one in the MCP directory.
More spare compute prompts
Free tools, calculators, templates and data pages that rank for long-tail searches and earn links on their own. Run these overnight and wake up to shippable pages.
Keyword research, content briefs, technical SEO audits and article drafts you can leave running overnight. Each prompt saves its output to a file so nothing gets lost.
Find link opportunities, draft pitches and build lists of podcasts, newsletters and journalists. These prompts do the slow research so you only do the sending.
Get listed everywhere your buyers look: startup directories, app stores, marketplaces, launch sites and review platforms. Claude prepares every listing so submitting takes minutes.
Lead lists, buying signals and the places your next customers are already asking for help. Claude does the digging; you decide who to contact.
Cold emails, follow-ups, sales pages and objection handling written from what your product actually does. Claude drafts; you review and send.
A month of posts, threads, carousels and replies drafted from your product, changelog and lessons learned. Wake up to a content queue instead of a blank page.
Demo videos, short-form scripts, animated explainers and screenshots generated with code. Use Remotion, Playwright and ffmpeg to render while you sleep.
Synthetic personas, simulated usability tests and interview prep built from your real product. Use them to find obvious problems before you spend time with real users, not instead of them.
Teardowns, pricing tracking, feature matrices and screenshots of competitor user flows. Leave a browser running overnight and come back to a full picture of the market.
Rewrite copy, audit the sign-up funnel, design A/B tests and build new landing pages. These prompts work directly in your codebase so the output is ready to review as a pull request.
Welcome sequences, onboarding emails, newsletters and re-engagement campaigns written from your actual product, plus the templates to send them.
Polish passes, onboarding fixes, feature specs and prototypes. Good for overnight runs because each one ends in a branch or a document you can review over coffee.
Tests, refactors, type safety, dependency upgrades and dead code removal. The classic overnight job: long, careful, and easy to review in the morning as a pull request.
Documentation, help centre articles, support macros, metrics, finance tidy-ups and the admin that piles up. Hand it to Claude when you have compute to spare.
Make Claude better at these jobs with skills, MCP servers and mods, or turn a prompt you run often into a skill with the skill generator.