Dorian Builds

🤖 I build fun stuff with AI

🌐 Building - 1 app for ALL your apps

🐶 Dog dad

[Dorian Builds @LiveLoveSEO]

Claude Code can delete your whole repo in one command..😳

The .git, commits, branchs, all gone

The 30 sec fix in .claude/settings.json:

"permissions": {
"deny": ["Bash(rm -rf:*)", "Bash(git push --force:*)"]
}

Now those get blocked even if it tries. Still push your work often tho!

[Dorian Builds @LiveLoveSEO]

I'm curious:

- which coding tool are you actually paying for right now?

- and which did you cancel if any?

[Dorian Builds @LiveLoveSEO]

might be common knowledge but just in case:

you can run a coding AI on your own laptop FOR FREE without API keys or subscription AND your code never leaves your machine!

1. install Ollama
2. run: ollama run qwen2.5-coder

its def slower than the big models but great for quick stuff!:)

[Dorian Builds @LiveLoveSEO]

Please stop describing UI bugs to your AI with words

Just take a screenshot and paste it in

Its soo much faster

[Dorian Builds @LiveLoveSEO]

Always check these 4 things before you ship:

1. no API keys in the code
2. every route checks who is logged in
3. user input never goes straight into SQL
4. your .env is in .gitignore

[Dorian Builds @LiveLoveSEO]

stop writing a different instructions file for every coding tool!

AGENTS.md is one file that codex, cursor and github copilot all read

if you use claude code too, it reads CLAUDE.md so put this one line in it:
@AGENTS.md

[Dorian Builds @LiveLoveSEO]

Cursor can read your .env file..😳

their own staff confirmed the agent can read it even tho .env is skipped for indexing

fix: just add this to a .cursorignore file in your project:
.env*

still not bulletproof (terminal commands can read it)
just keep real secrets out of the project folder

[Dorian Builds @LiveLoveSEO]

sunday tip:

before you let ANY agent touch your code:

> git switch -c ai-try → work on a branch not main
> git diff → see what it changed
> git restore . → undo its edits to your files

new files it made stay put, just delete those yourself

[Dorian Builds @LiveLoveSEO]

if you vibecoded an app on Supabase, check this today:

> your anon key sits in your frontend code, anyone can find it

> if a table has row level security OFF, that key can read and write to it

FIX:
alter table your_table enable row level security

then add policies for what your app actually needs

[Dorian Builds @LiveLoveSEO]

"make it better" is the WORST prompt you can give an agent

instead say the one thing you want changed and how you'll check it worked

[Dorian Builds @LiveLoveSEO]

you closed your terminal in the middle of a Claude code task?

claude -c → continue your last conversation
claude --resume → pick any older one from a list

the conversation is saved, just tell it to pick up where it left off:)

[Dorian Builds @LiveLoveSEO]

if you running claude with --dangerously-skip-permissions on your main pc, one bad command and it can touch anything you can..

use that mode inside a container or a throwaway vm, never on the machine with your keys and photos!

[Dorian Builds @LiveLoveSEO]

unpopular opinion: your claude md file is too long

it loads into every session. every rule competes with the actual task

i'd keep only the rules it actually breaks and delete the rest

[Dorian Builds @LiveLoveSEO]

before you let ai refactor anything, paste this first:

"Before changing any code, tell me what this code does today, the 3 riskiest parts and which tests will prove it still works after. Then stop and wait for me"

now its a plan you can check

[Dorian Builds @LiveLoveSEO]

if you vibecode an app with your OpenAi key or stripe secret key in it, anyone can open devtools and copy it if the key is in your frontend code!

keep keys on a server, the browser should only ever talk to your own api

[Dorian Builds @LiveLoveSEO]

every mcp server you add to your coding agent runs with YOUR permissions

it can read your files and run whatever its tools allow

before you install one make sure you know:
- who made it
- is the code public
- what tools does it add

and to see whats already installed:
claude mcp list

[Dorian Builds @LiveLoveSEO]

5. turn off mcp servers you dont use (/mcp). they can add tool descriptions to your context

[Dorian Builds @LiveLoveSEO]

1. type /context to see whats taking up space

[Dorian Builds @LiveLoveSEO]

4. keep your claude md file short, it loads into every session