⚡ What are the best AI prompts for coding and software development? (Direct answer)

The best AI coding prompts are specific about language, framework, error message, and desired output format. Vague prompts like "fix my bug" produce guesses. The 50 prompts below are engineered around the real tasks developers face — structured debugging workflows, targeted code reviews, architecture trade-off analysis, auto-generated documentation, comprehensive test suites, refactoring plans, security audits, and CI/CD design — all copy-paste ready with bracket placeholders for ChatGPT, Claude, and Gemini.

🔍 About This Guide — E-E-A-T & Editorial Standards

Why You Can Trust This Prompt Library

🧑‍💻Curated by Rohit Sharma, Technical SEO Specialist & Founder of IndexCraft. Every prompt has been tested across ChatGPT (GPT-4o), Claude (Sonnet 4.6), and Gemini 1.5 Pro against real codebases in Python, JavaScript/TypeScript, Go, SQL, and Java before publication.
🎯Structured for GEO and AI retrieval: Each prompt is self-contained, language-agnostic at the template level, and produces structured output developers can use immediately — the same qualities that make content citable in AI Overviews and LLM-powered search responses.
⚠️Important note: AI-generated code, tests, and architecture recommendations are starting points, not production-ready outputs. Always review AI suggestions against your codebase's actual constraints, security requirements, and team conventions. Never ship AI-generated code without understanding what it does.
50 Copy-paste prompts across 8 developer categories — tested on ChatGPT, Claude & Gemini
8 Categories: Debugging · Review · Architecture · Docs · Testing · Refactoring · Security · DevOps
55% Of developers report AI coding tools save them more than 2 hours per week on documentation and testing alone (GitHub, 2025)
📌 How to use these prompts: Every prompt uses [brackets] for the parts you fill in — your language, error message, code snippet, or architectural constraints. Replace every bracketed placeholder before sending. Paste your actual code where indicated. The more context you give the AI, the more precise and immediately usable the output. Start with one prompt for your current task rather than planning to use all 50.

🐛 Debugging Prompts (1–7)

These prompts turn the frustrating trial-and-error of debugging into a structured diagnostic process. Each one is designed to extract the maximum signal from your error message, code context, and reproduction steps — so the AI can reason about root causes rather than guess at symptoms.
1 Bug Diagnosis & Root Cause Finder Systematic root-cause analysis for any bug — beyond "try this fix"

Most AI debugging responses jump straight to a fix without diagnosing the root cause. This prompt forces a structured diagnostic process — identifying what's actually wrong before proposing solutions, and ranking hypotheses by likelihood so you don't chase the wrong fix first.

Act as a senior software engineer specialising in debugging. I have a bug I need you to diagnose systematically — do not jump to a fix until you have identified the most likely root cause.

Language / Framework: [e.g. Python 3.11 / FastAPI]
What I expected to happen: [describe the intended behaviour]
What actually happens: [describe the observed behaviour, including any error output]
Error message (paste in full, including stack trace): [paste here]
Relevant code snippet: [paste the function or block where the issue occurs]
When the bug first appeared: [e.g. after a dependency update / always / intermittently / after a specific code change]
What I've already tried: [list your attempts]

Please:
1. Identify the 3 most likely root causes, ranked by probability — explain the reasoning for each
2. For the most probable cause: describe exactly what is happening in the code at the point of failure
3. List the minimum code change needed to fix the most probable cause — no refactors, just the fix
4. Suggest a way to verify the fix is correct before committing it
5. Flag any secondary issues in the code that could cause related bugs in future — separate from the immediate fix
Pro tip: Always paste the full stack trace, not just the final error line. The most informative line is often three or four frames above the bottom — where your code hands off to a library or framework. AI models use the full trace to pinpoint exactly where control flow diverged from your expectations.
✅ ChatGPT ✅ Claude ✅ Gemini
2 Error Message Decoder Translate cryptic error messages into plain English with a fix path

Cryptic compiler errors, obscure library exceptions, and framework-specific stack traces can take hours to decode without guidance. This prompt extracts every piece of information the error message contains and maps it to an actionable fix path.

Act as a debugging expert. Decode this error message completely — explain what every part of it means, not just the final line.

Language / Runtime: [e.g. Node.js 20, Python 3.12, Java 21, Rust 1.78]
Full error output (paste entirely — do not truncate):
[paste here]

Context where the error occurs:
[paste the relevant code block]

Please:
1. Decode every line of the error message in plain English — what each part tells us
2. Identify the exact file, line, and operation where the error originates
3. Explain the underlying cause in one sentence a junior developer could understand
4. Provide the most likely fix — with the specific change needed, not just the concept
5. Explain any technical terms in the error that are worth understanding for future debugging
6. If this is a library or framework error: link the error to the concept in the library documentation that governs this behaviour (describe the concept, not a URL)
Pro tip: For TypeScript and Java errors with long generic type signatures, ask the AI to "simplify the type error by replacing generic parameters with concrete examples from the code." This converts abstract type algebra into readable diagnostics that tell you exactly what the compiler expected versus received.
✅ Claude ✅ ChatGPT ✅ Gemini
3 Runtime Performance Debugger Diagnose slow code paths, memory spikes, and performance regressions

Performance bugs are harder to diagnose than crash bugs because they don't throw errors — they silently degrade user experience. This prompt structures a performance investigation around your specific symptoms, code, and profiling data rather than generic "avoid N+1 queries" advice.

Act as a performance engineering expert. Help me diagnose a runtime performance problem in my code.

Language / Framework: [e.g. Python / Django, Go, Java / Spring Boot]
Symptom: [e.g. API endpoint takes 4s instead of expected 200ms / memory grows 100MB per hour / CPU spikes to 95% under moderate load]
When it happens: [e.g. only under load / always / with large datasets / after X hours of uptime]
Profiling data (if available — paste any profiler output, flame graph text, or timing logs):
[paste here or describe what you've measured]
Relevant code (paste the slow function or endpoint handler):
[paste here]
Database queries involved (if applicable — paste the ORM call or raw SQL):
[paste here]

Please:
1. Identify the most likely performance bottleneck from what I've provided — explain the mechanism
2. Classify the bottleneck: CPU-bound / IO-bound / memory / network / database / algorithmic complexity
3. Estimate the theoretical improvement available if the bottleneck is fixed
4. Provide a specific fix or optimisation — not general advice
5. Suggest the minimum profiling instrumentation I should add to confirm the bottleneck and measure the fix
6. Flag any secondary performance risks in the code I've shared
Pro tip: Before running this prompt, add simple timing instrumentation around the slowest suspected block. Even print(time.time()) at key points gives the AI concrete data to reason from rather than guessing. Measured data beats intuition in performance debugging every time.
✅ Claude ✅ ChatGPT ✅ Gemini
4 Logic Error Detective Find bugs where the code runs without errors but produces wrong results

Logic errors are the hardest bugs — no stack trace, no exception, just wrong output. The AI needs your expected vs actual values and the code that produced them. This prompt structures that evidence into a systematic correctness analysis.

Act as a senior engineer doing correctness analysis. My code runs without errors but produces wrong output. I need you to trace through the logic and find where it diverges from my intention.

Language: [e.g. JavaScript, Python, Go]
What the function is supposed to do: [describe the intended behaviour in plain English]
Input I'm testing with: [paste the specific input value(s)]
Output I expected: [exact expected value or structure]
Output I actually got: [exact actual value or structure]
The code: [paste the complete function or block]

Please:
1. Trace through the code step-by-step with my specific input — show the value of key variables at each step
2. Identify exactly where the output diverges from the expected result
3. Explain why the code produces the wrong output — the logical flaw, not just the symptom
4. Provide the corrected code with the minimal change needed to fix the logic
5. Suggest 2–3 test cases that would catch this type of logic error in future (including one edge case I may not have thought of)
Pro tip: For complex logic bugs, ask the AI to "walk through this with a simpler concrete example first" before applying it to your real input. Tracing with simple values (e.g. [1, 2, 3] instead of a 500-row dataset) makes the logic error visible at every step without noise from scale.
✅ Claude ✅ ChatGPT ✅ Gemini
5 Environment & Dependency Debugger Debug "works on my machine" issues — version conflicts, missing deps, env vars

"Works on my machine" bugs are reproducibility failures — the environment, not the code, is the variable. This prompt structures the environment investigation so differences between machines, containers, or stages are methodically surfaced.

Act as a DevOps and environment debugging specialist. I have a bug that appears in one environment but not another. Help me isolate the environmental cause.

Language / Runtime: [e.g. Node.js 18, Python 3.10]
Works in: [e.g. my local Mac / dev environment / Docker container]
Fails in: [e.g. CI/CD pipeline / staging server / another developer's machine / production]
Error in the failing environment (full output): [paste here]
My dependency file (paste package.json / requirements.txt / go.mod / Gemfile etc.): [paste here]
Environment variables that differ between environments (redact sensitive values with placeholder text): [list them]
OS / runtime version differences if known: [describe]

Please:
1. Identify the most likely environmental cause — version mismatch / missing env var / OS difference / path issue / network policy / permission
2. Produce a checklist of things to verify in the failing environment to confirm the cause
3. Suggest the minimum change needed to make the environment consistent — don't redesign the whole setup
4. Recommend one tool or technique to lock this environment difference from recurring (e.g. .nvmrc, Docker pinning, pyproject.toml constraints)
5. Flag any dependency in my lockfile that is pinned loosely and could cause silent version drift in future
Pro tip: Environment bugs almost always come down to three things: runtime version, dependency version, or an environment variable. Before running this prompt, diff your package-lock.json, poetry.lock, or equivalent lockfile between the two environments. The diff output is the highest-signal input you can give the AI.
✅ Claude ✅ ChatGPT ✅ Gemini
6 Async & Concurrency Bug Hunter Debug race conditions, deadlocks, and async/await failures

Async and concurrency bugs are uniquely difficult — they're often non-deterministic, impossible to reproduce reliably, and invisible in unit tests. This prompt structures the evidence gathering and diagnostic reasoning needed to identify race conditions, deadlocks, and async/await misuse.

Act as a concurrency and async programming expert. Help me diagnose a bug that involves asynchronous code, parallel execution, or shared state.

Language / Concurrency model: [e.g. JavaScript async/await, Python asyncio, Go goroutines, Java CompletableFuture, Rust async]
Bug description: [e.g. intermittent failure / deadlock / race condition / incorrect data / requests sometimes never complete]
Frequency: [always / intermittent — roughly what % of the time]
The code (paste the async function, goroutine, thread, or concurrent section): [paste here]
Any locks, mutexes, or synchronisation primitives in use: [describe or paste]
What shared state is being accessed: [describe the shared variables or resources]

Please:
1. Identify the concurrency hazard: race condition / deadlock / livelock / starvation / async misuse (missing await / unhandled promise rejection)
2. Explain the exact execution sequence that produces the bug — draw out the interleaving if it's a race condition
3. Provide the corrected code — with the synchronisation or async fix applied
4. Explain why the fix works in terms of the memory model or event loop
5. Suggest how to test for this type of concurrency bug — since unit tests often can't catch it reliably
Pro tip: For intermittent concurrency bugs, add structured logging with timestamps and goroutine/thread IDs, then run the code under high concurrency to force the bug to surface. The log sequence showing which operation happened before which is the key evidence. Paste that log output into this prompt for the most accurate diagnosis.
✅ Claude ✅ ChatGPT ✅ Gemini
7 Rubber Duck Debugger Talk through a problem you can't solve — let the AI ask the right questions

Sometimes the best debugging tool isn't a fix — it's the right questions. This prompt puts the AI in the role of a patient, probing senior engineer who asks the questions that help you discover the answer yourself, rather than jumping to a solution that might not fit your full context.

Act as a patient senior engineer doing rubber duck debugging with me. Do not give me a solution yet. Instead, ask me probing questions that help me think through the problem systematically.

My problem (describe it as clearly as you can — include what you've tried):
[describe your problem]

Start by asking me questions in this order:
1. Clarifying questions about what the code is supposed to do
2. Questions about what I've already ruled out and how
3. Questions about the conditions under which the bug does and doesn't appear
4. Questions about recent changes to the codebase, dependencies, or environment
5. Questions about any assumptions I'm making that I haven't verified

After I answer each round, either ask a follow-up question that narrows further, or — if you think we've found the root cause — explain what you believe the issue is and why, then ask me to confirm before suggesting a fix.
Pro tip: The rubber duck technique works because explaining the problem forces you to surface assumptions you've stopped questioning. The AI's questions are most useful when they push you into the parts of the system you've been unconsciously avoiding. Follow up with "ask me about the part of this system I haven't mentioned yet."
✅ Claude ✅ ChatGPT ✅ Gemini

🔍 Code Review Prompts (8–13)

These prompts produce targeted, lens-specific code reviews — not a generic "looks good, maybe add comments" pass. Each prompt directs the AI to review against a specific dimension: security, performance, readability, PR readiness, or anti-pattern detection. Use the lens that matches your current priority.
8 Structured Code Review Comprehensive review covering correctness, design, readability, and tests

A structured code review covers more ground than a quick scan for bugs. This produces a prioritised, actionable review across correctness, design quality, readability, error handling, and test coverage — with severity labels so you know what to fix first.

Act as a senior software engineer conducting a thorough code review. Review the code below and provide structured, prioritised feedback.

Language / Framework: [e.g. TypeScript / Express, Python / FastAPI]
Context — what this code does: [describe the function or module's purpose]
Context — where it runs: [e.g. server-side API endpoint / browser client / background job / CLI tool]
Existing test coverage (if any): [describe or say "none"]
Code to review:
[paste code here]

Please structure your review with severity labels:

🔴 CRITICAL — Must fix before shipping (correctness bugs, security holes, data loss risks)
🟠 HIGH — Should fix before shipping (significant design problems, error handling gaps)
🟡 MEDIUM — Should fix soon (readability, maintainability, missing tests)
🟢 LOW — Nice to have (style, minor optimisations, documentation)

For each issue:
- Line reference (if applicable)
- What the problem is
- Why it matters
- Specific suggested fix or alternative

Finish with: a one-paragraph overall assessment — is this code ready to ship, needs minor work, or needs significant revision?
Pro tip: Run this review before requesting a human PR review. Catching the AI's high-severity items first means your human reviewer can focus on design and context — the things AI misses — rather than spending their review budget on issues the AI would have caught in 30 seconds.
✅ Claude ✅ ChatGPT ✅ Gemini
9 Security-Focused Code Audit Review code specifically for OWASP vulnerabilities and security anti-patterns

Security reviews require a different mindset than correctness reviews — you're looking for what an adversary could exploit, not just what a user would notice. This directs the AI to audit against the OWASP Top 10 and common language-specific security pitfalls.

Act as an application security engineer performing a security-focused code audit. Review the code below for vulnerabilities — think like an attacker trying to exploit this code.

Language / Framework: [e.g. Python / Django, Node.js / Express, PHP / Laravel]
What this code handles: [e.g. user authentication / payment processing / file uploads / external API calls / database queries]
Data sensitivity: [e.g. processes PII / financial data / public data only]
Authentication context: [e.g. endpoint is public / requires JWT / internal service only]
Code to audit:
[paste code here]

Please check for and report on:
1. Injection vulnerabilities (SQL injection, command injection, XSS, SSTI)
2. Authentication and session management flaws
3. Insecure direct object references (IDOR) or broken access control
4. Sensitive data exposure (secrets in code, unencrypted data, over-exposed API responses)
5. Security misconfiguration
6. Insecure deserialisation
7. Missing input validation or insufficient output encoding
8. Dependency or third-party risks

For each finding: severity (Critical / High / Medium / Low), the vulnerable code snippet, the attack vector an adversary would use, and the specific remediation.
Pro tip: Never paste real credentials, production API keys, or real PII into AI prompts — even for security review. Replace sensitive values with clearly labelled placeholders before pasting. The AI can still audit the code structure and data handling patterns without seeing the actual secrets.
✅ Claude ✅ ChatGPT ✅ Gemini
10 Performance Code Review Review code for algorithmic complexity, unnecessary allocations, and bottlenecks

Performance problems are often invisible until they're in production. This review identifies complexity issues, memory allocations, database query patterns, and caching opportunities before they become production incidents.

Act as a performance engineering expert. Review the code below for performance problems — focus on algorithmic complexity, resource usage, and scalability concerns.

Language / Framework: [e.g. Python / Django, Java / Spring]
Scale context: [e.g. this runs on every HTTP request / processes 1M records per night / called 50 times/second under load]
Expected data size: [e.g. input list could be 10–100k items / table has 50M rows]
Code to review:
[paste code here]
Database queries (if relevant, paste ORM or SQL):
[paste here]

Please analyse:
1. Time complexity of the core algorithm — Big-O notation and explanation
2. Space complexity — memory allocation patterns and any obvious leaks
3. Database query issues — N+1 queries, missing indexes, unnecessary full table scans, over-fetching
4. Loop inefficiencies — unnecessary iterations, redundant computations, misuse of data structures
5. Caching opportunities — what could be memoised, cached, or pre-computed
6. I/O blocking — synchronous calls that could be async, unnecessary serialisation/deserialisation

For each issue: estimate the performance impact (negligible / noticeable / severe at scale) and provide a specific optimised alternative.
Pro tip: Provide the scale context honestly. A loop that's fine at 100 items is catastrophic at 100,000. Telling the AI "this runs on every API request with a table that currently has 2 million rows and grows by 50k per week" gives it the data to separate real performance risks from theoretical micro-optimisations.
✅ Claude ✅ ChatGPT ✅ Gemini
11 Readability & Maintainability Review Review code for clarity, naming, complexity, and long-term maintainability

Code that works but can't be understood is technical debt with a timer. This review targets the maintainability dimensions that slow teams down six months after code is written: naming, cognitive complexity, coupling, and the absence of self-documenting patterns.

Act as a senior engineer focused on code quality and long-term maintainability. Review the code below — assume this code will be read by a developer who has never seen it before, six months from now.

Language: [e.g. TypeScript, Python, Go]
Team context: [e.g. solo project / small startup team / large engineering org with many contributors]
Existing style guide or conventions: [describe or say "none enforced"]
Code to review:
[paste code here]

Please evaluate and flag issues in:
1. Naming — variables, functions, and classes that don't clearly communicate intent
2. Function and class size — functions that do too much, violate single responsibility
3. Cognitive complexity — deeply nested conditionals, complex boolean logic, magic numbers
4. Coupling and cohesion — things that are unnecessarily tangled or separated that should be together
5. Comments — missing where needed, misleading where they exist, or redundant (comments that just repeat the code)
6. Error handling — silent failures, swallowed exceptions, missing validation
7. Duplication — copy-pasted logic that should be extracted

For each: quote the problematic code, explain the maintainability risk, and show the improved version.
Pro tip: Ask the AI to specifically rate the "bus factor" of each function — "if the author of this function left the company, how quickly could another developer understand and modify it?" This frames the feedback in terms that make sense to non-technical managers and creates urgency around documentation and clarity improvements.
✅ Claude ✅ ChatGPT ✅ Gemini
12 Pull Request Review Assistant Generate a structured, PR-ready review with inline comments and a summary

This prompt produces a review in the format of a professional pull request review — with inline comment-style feedback, a summary verdict, and a clear list of blockers vs suggestions. Use it to prepare your own PR, or to accelerate a review you're conducting.

Act as a senior engineer reviewing a pull request. Produce your review in the format of a GitHub PR review — with inline comments referencing specific lines, a summary, and a clear verdict.

PR title / description: [paste PR description or describe the change]
Type of change: [e.g. new feature / bug fix / refactor / performance improvement / breaking change]
Language / Framework: [e.g. TypeScript / React, Go / gRPC]
Diff or changed code (paste the changed files or functions):
[paste here]
Tests added (if any): [paste or describe]

Please produce:

PR SUMMARY REVIEW
- Overall assessment: [Approve / Approve with suggestions / Request changes]
- What this PR does well:
- Primary concerns:

INLINE COMMENTS (format each as):
[File: filename.ext, Line ~N]: [Comment text — issue or suggestion]

BLOCKERS (must fix before merge):
[list]

SUGGESTIONS (non-blocking improvements):
[list]

QUESTIONS for the author:
[list anything that needs clarification before you can fully approve]
Pro tip: When reviewing your own PR before submitting it, add "also review this from the perspective of someone who has no context on why this change was made." It catches the gaps in your PR description that will generate the most back-and-forth with reviewers.
✅ Claude ✅ ChatGPT ✅ Gemini
13 Anti-Pattern Detector Identify code anti-patterns, code smells, and framework misuse

Anti-patterns are recognisable patterns of bad practice that recur across codebases. They're easy to write, hard to spot when you're close to the code, and expensive to fix after they've spread. This review targets them explicitly.

Act as a code quality expert. Review the code below specifically for anti-patterns, code smells, and misuse of language or framework features.

Language / Framework: [e.g. Python, JavaScript / React, Java / Spring, Go]
Code to review:
[paste code here]

Please identify:

GENERAL CODE SMELLS:
- God objects / classes that know too much
- Long methods doing too many things
- Feature envy (a function that's more interested in another class's data)
- Primitive obsession (using raw strings/ints where domain types should exist)
- Shotgun surgery (one change requires many small changes across many places)
- Dead code — unreachable branches, unused variables, stale imports

LANGUAGE-SPECIFIC ANTI-PATTERNS for [language]:
[AI should identify the relevant anti-patterns for the specified language, e.g. for Python: mutable default args, bare except, overusing *args/**kwargs; for JS: callback hell, prototype pollution risk, implicit globals]

FRAMEWORK MISUSE for [framework]:
[AI should identify misuse patterns specific to the named framework]

For each finding: name the anti-pattern, show the problematic code, explain the consequence, and provide the idiomatic alternative.
Pro tip: Run this prompt after refactoring sessions, not before — anti-pattern reviews on old code generate a list too long to action. After a focused refactor, you want to verify you haven't introduced new anti-patterns while fixing old ones. This prompt as a post-refactor check is high signal.
✅ Claude ✅ ChatGPT ✅ Gemini

🏗️ Architecture & Design Prompts (14–20)

These prompts support high-stakes architectural decisions — system design, service decomposition, data modelling, API design, scalability planning, and technology selection. Architecture decisions are expensive to reverse; these prompts surface trade-offs and failure modes before you commit.
14 System Architecture Designer Design a high-level system architecture for a new product or feature

Starting a new system from scratch without a design leads to expensive mid-build rearchitecting. This prompt produces a reasoned, trade-off-aware architecture proposal — covering components, data flow, external integrations, and the decisions that need to be made before coding starts.

Act as a principal software engineer and solutions architect. Design a high-level system architecture for the following requirement.

What I'm building: [describe the product, feature, or service in plain English]
Expected scale: [e.g. 100 users at launch / 10k daily active users / 1M requests per day]
Team size and capability: [e.g. 2 full-stack engineers / 5 backend engineers with strong Python / solo developer]
Existing infrastructure or constraints: [e.g. already on AWS / must use existing PostgreSQL / no budget for managed services / must be on-premise]
Key non-functional requirements: [e.g. must be GDPR-compliant / 99.9% uptime SLA / response time under 100ms / offline capability]
Timeline to first production deployment: [e.g. 6 weeks, 3 months]

Please produce:
1. High-level component diagram (described in text — list components and how they connect)
2. Data flow — how data moves through the system from user action to storage to response
3. Key technology recommendations for each component — with brief justification
4. The 3 highest-risk architectural decisions I need to make before starting, and a recommended choice for each
5. What this architecture will struggle with at 10× the expected scale — and the trigger point to rearchitect
6. What I should NOT build yet — components to defer until the system proves itself
Pro tip: Always give the AI an honest team size and capability assessment. An architecture that needs a distributed systems expert to operate is not a good architecture for a two-person startup. The best architecture is the most boring one that reliably meets your requirements — not the most technically impressive one.
✅ Claude ✅ ChatGPT ✅ Gemini
15 Microservices Decomposition Advisor Decide how to split a monolith — or whether you should at all

Microservices are often adopted prematurely, creating distributed system complexity without the scale to justify it. This prompt analyses your specific situation — including team size, domain complexity, and operational maturity — before recommending if, when, and how to decompose.

Act as a solutions architect who has migrated several monoliths to microservices — and seen several go badly. Advise me on service decomposition for my situation.

Current system: [describe the monolith or existing architecture]
Current pain points driving the decomposition discussion: [e.g. deployment bottlenecks / scaling a specific component / team coordination / technology heterogeneity]
Domain areas or bounded contexts I've identified: [list the business domains or capabilities — e.g. user management, payments, notifications, inventory]
Team structure: [e.g. 1 backend team of 8 / 3 independent squads / 2 developers total]
Current operational maturity: [e.g. no k8s experience / running on managed k8s / strong DevOps team / no dedicated ops]
Scale of the specific component I think needs to scale independently: [describe]

Please:
1. Give me an honest assessment — is microservices decomposition the right solution for my actual problem? What alternatives should I consider first?
2. If decomposition is justified: recommend the first service to extract and the boundary to draw — based on domain independence and team ownership
3. Identify the strangler fig pattern steps for extracting the first service without a big-bang rewrite
4. List the operational prerequisites I need in place before running microservices in production
5. Flag the 3 most common mistakes teams make at my stage of decomposition
Pro tip: Martin Fowler's "microservices premium" is real — you pay with distributed system complexity, network latency, operational overhead, and debugging difficulty. Ask the AI to estimate the concrete operational overhead (monitoring, deployment, service discovery, distributed tracing) for your team size before committing.
✅ Claude ✅ ChatGPT ✅ Gemini
16 Database Schema Architect Design or review a database schema for correctness, normalisation, and performance

A bad schema is one of the most expensive technical debts in software — it's hard to migrate, slow to query, and wrong from day one. This prompt designs or reviews a schema with explicit attention to normalisation, indexing strategy, and query access patterns.

Act as a database architect. Design or review a database schema based on the requirements below.

Database engine: [e.g. PostgreSQL 16, MySQL 8, SQLite, MongoDB, DynamoDB]
What I'm modelling: [describe the domain — e.g. e-commerce orders, SaaS user accounts and billing, social media posts and reactions]
My current schema or draft (paste DDL, describe tables, or describe entities):
[paste or describe]
Expected data volume: [e.g. 10k users / 100M events per month / billions of time-series records]
Primary query patterns — the 3–5 most frequent queries this schema must serve efficiently:
[describe each: e.g. "look up all orders for a user in the last 30 days sorted by date"]
Write-heavy or read-heavy: [describe the ratio]

Please:
1. Identify any normalisation violations — and whether to fix or intentionally denormalise for performance
2. Review relationships — are foreign keys correct? Are there any missing constraints?
3. Recommend an indexing strategy for my primary query patterns — which columns to index and why
4. Flag any schema decisions that will cause pain at 10× current scale
5. Identify any columns or tables that suggest a modelling misunderstanding of the domain
6. Suggest any schema changes that would make the 3 most frequent queries more efficient
Pro tip: State your query patterns before asking for index recommendations. Indexes are designed around queries, not around the schema. An index that speeds up your most common query is worth ten indexes added speculatively. Give the AI your top 3 queries in raw SQL or ORM form for the most targeted index strategy.
✅ Claude ✅ ChatGPT ✅ Gemini
17 API Design Reviewer Review a REST or GraphQL API design for correctness, usability, and consistency

A poorly designed API is a contract you'll be stuck with for years — inconsistent naming, wrong HTTP semantics, missing versioning, and leaky domain models cause integration pain long after launch. This reviews your API design before it's locked in.

Act as an API design expert. Review my API design for correctness, usability, and long-term maintainability.

API type: [REST / GraphQL / gRPC / WebSocket]
API consumers: [e.g. internal frontend only / third-party developers / mobile apps / other backend services]
My API design (paste OpenAPI spec, route definitions, or describe endpoints):
[paste here]
Authentication method: [e.g. JWT Bearer / API key / OAuth 2.0 / session cookie]

Please review for:
1. HTTP method semantics — are GET/POST/PUT/PATCH/DELETE used correctly?
2. URL structure — are resources named correctly (nouns, not verbs), are hierarchies logical?
3. Status codes — are the right HTTP status codes returned for each case?
4. Request/response shapes — are payloads consistent, well-named, and free of internal domain leakage?
5. Error response format — is the error schema consistent and developer-friendly?
6. Versioning strategy — is there one, and is it appropriate?
7. Pagination — are list endpoints paginated, and is the pagination pattern standard?
8. Security — are endpoints appropriately protected and returning only what consumers need?

For each issue: the problem, the consequence for API consumers, and the recommended fix.
Pro tip: The best time to run this prompt is before writing a single line of implementation. Once the API is consumed by a client — internal or external — changing the contract requires versioning and migration work. API design is architecture; it deserves the same front-loaded review as any other architectural decision.
✅ Claude ✅ ChatGPT ✅ Gemini
18 Scalability & Load Planning Advisor Plan for growth before your system is under stress

Scalability problems discovered in production under load are the most expensive kind. This prompt builds a capacity model for your system — identifying bottlenecks, estimating break points, and designing the scale path before you need it.

Act as a systems architect with deep experience in scaling web applications. Help me plan for scalability before my system hits load limits.

Current architecture: [describe your stack — web server, database, caching layer, message queue, etc.]
Current load: [e.g. 500 requests/day / 200 concurrent users / 50k records in DB]
Expected load in 6 months: [best estimate]
Expected load in 2 years: [best estimate — be honest if uncertain]
The component most likely to be the first bottleneck under load: [your hypothesis]
Current infrastructure: [e.g. single VPS, 3 EC2 instances, managed Kubernetes, serverless]
Budget constraints for scaling: [e.g. must stay under $500/month / no constraint / enterprise budget]

Please:
1. Identify the actual first bottleneck — confirm or challenge my hypothesis with reasoning
2. Estimate the approximate load at which each major component (web tier, database, cache, storage) will fail under current architecture
3. Design a scale path: what to do first, second, and third — as load grows — without over-engineering prematurely
4. Identify the lowest-cost, highest-impact change I can make today to increase capacity headroom
5. Describe the load test I should run this week to validate these estimates with real data
Pro tip: Run a load test before you think you need to scale — not during an incident. Tools like k6, Locust, or wrk can simulate your expected traffic in 20 minutes. Give the AI the load test results and it can pinpoint bottlenecks with much more precision than from architecture descriptions alone.
✅ Claude ✅ ChatGPT ✅ Gemini
19 Tech Stack Decision Framework Choose a language, framework, or database with a structured trade-off analysis

Technology decisions made on vibes or trends are among the most expensive mistakes a team makes. This prompt structures a technology decision around your actual constraints — team skills, operational maturity, scale, and ecosystem — rather than hype.

Act as a technology advisor with no vendor affiliation. Help me make a structured technology decision — not based on trends, but on my actual constraints and requirements.

Decision I'm making: [e.g. which backend framework / which database / which message queue / which frontend framework / which cloud provider]
Options I'm considering: [list 2–4 options you want compared]
My requirements (rate each 1–5 for importance):
- Performance: [1–5]
- Developer experience: [1–5]
- Operational simplicity: [1–5]
- Ecosystem maturity: [1–5]
- Hire-ability (can I find engineers who know this): [1–5]
- Total cost of ownership: [1–5]
Team's current skills: [describe what the team knows well vs is learning]
Scale I need to support: [describe]
Any hard constraints: [e.g. must be open source / must run on-premise / must have SOC2 compliance / must integrate with X]

Please:
1. Score each option against my requirements — justify each score in one sentence
2. Name the winner for my specific constraints — give a clear recommendation, not "it depends"
3. Describe the top risk of choosing the recommended option
4. Describe the scenario in which I should choose the second option instead
5. Flag any option that looks good on paper but has a known hidden cost for teams at my scale
Pro tip: "Hire-ability" is consistently the most underrated constraint. A technically superior choice that your next three hires have never touched adds six months of ramp-up time per engineer. The best technology is the one your team can operate confidently — not the one with the best benchmark numbers.
✅ Claude ✅ ChatGPT ✅ Gemini
20 Architecture Trade-off Analyser Evaluate the trade-offs of a specific architectural decision before you commit

Every architectural decision is a trade-off — consistency vs availability, simplicity vs flexibility, cost vs performance. This prompt makes the trade-offs explicit, so you're choosing with full awareness rather than discovering the costs six months later.

Act as a principal architect. Analyse the trade-offs of a specific architectural decision I'm making — give me the full picture before I commit.

The decision: [describe the architectural choice, e.g. "use eventual consistency with an event-driven architecture vs strong consistency with synchronous calls" or "store files in S3 vs in the database vs on local disk"]
My context: [describe the system, team, and constraints this decision fits into]
Why I'm leaning toward option A: [describe your current thinking]
What concerns me about option A: [describe your doubts]
Option B (the alternative): [describe]

Please analyse:
1. What option A optimises for — what becomes easier, faster, or cheaper
2. What option A makes harder — the costs, constraints, or failure modes it introduces
3. The same analysis for option B
4. The conditions under which option A is clearly the better choice
5. The conditions under which I should pick option B instead
6. The decision criteria most likely to change in the next 12–18 months that would make me regret picking option A today
7. Your recommendation — and the one question I should answer before committing to it
Pro tip: The most valuable part of this prompt is item 6 — what might change that would make you regret the choice. Architecture decisions last for years. Thinking about how your requirements might shift (scale, team size, regulatory environment, business model) forces you to evaluate reversibility, not just fit.
✅ Claude ✅ ChatGPT ✅ Gemini

📝 Documentation Prompts (21–25)

These prompts generate production-quality technical documentation from your code or descriptions — covering READMEs, inline comments, API references, Architecture Decision Records, and developer onboarding guides. Good documentation is not a nice-to-have; it's the leverage that multiplies your team's velocity.
21 README Generator Generate a professional, complete README for any project or repository

A good README is the difference between a project someone can use in 10 minutes and one that gets abandoned after failing to run locally. This generates a structured, comprehensive README covering all the sections that actually matter.

Act as a technical writer. Generate a professional, complete README.md for my project.

Project name: [name]
What it does (one sentence): [describe]
Who it's for: [e.g. developers building X / data scientists / end users of Y type]
Tech stack: [e.g. Python 3.11, FastAPI, PostgreSQL, Docker]
Key features: [list 3–5 main features]
Installation prerequisites: [e.g. Python 3.10+, Docker, a PostgreSQL instance]
How to install and run locally (describe the steps or paste them): [describe]
How to run tests: [command or description]
Configuration — key environment variables: [list them, with descriptions]
Any API or CLI interface to document: [describe or paste]
License: [e.g. MIT, Apache 2.0, proprietary]
Project status: [e.g. early alpha / production-stable / actively maintained / archived]

Please generate a README.md with these sections:
1. Project name + one-line description + badges (build status, license, version)
2. Overview — what problem this solves and why it exists
3. Quick start — get it running in under 5 commands
4. Features
5. Installation — full step-by-step
6. Configuration — environment variables with examples
7. Usage — code example or CLI example
8. Running tests
9. Contributing (brief)
10. License
Pro tip: Write the README before you write the code. If you can't describe what the project does, who it's for, and how to run it — in that order — you don't have a clear enough concept to build. README-driven development forces clarity at the design stage, not the documentation stage.
✅ Claude ✅ ChatGPT ✅ Gemini
22 Inline Code Comment Writer Add clear, useful inline comments and docstrings to existing code

Good inline comments explain why, not what. Bad comments just restate the code. This prompt generates inline comments and docstrings that explain intent, non-obvious decisions, and the context that future maintainers need — without cluttering obvious code.

Act as a technical writer who understands code deeply. Add inline comments and docstrings to the code below — following the principle that comments should explain WHY, not WHAT.

Language: [e.g. Python, TypeScript, Go, Java]
Docstring format: [e.g. Google style / NumPy / JSDoc / GoDoc / JavaDoc / just clear prose]
Audience for the comments: [e.g. junior developers / senior engineers unfamiliar with this domain / public API users]
Code to document:
[paste code here]

Rules for your comments:
1. Docstring / JSDoc for every public function, class, and method — including params, return types, raises/throws
2. Inline comments only where the logic is non-obvious — not for self-explanatory code
3. Comments that explain the WHY behind non-obvious decisions (e.g. "using insertion sort here because n is always < 10")
4. Warning comments for known gotchas or footguns in the function
5. TODO comments for anything that should be improved but isn't being changed now
6. Do NOT add comments like "# increment i by 1" above "i += 1" — only add value

Return the fully commented code.
Pro tip: After the AI adds comments, read each one and ask: "Could I have inferred this from the code itself in 5 seconds?" If yes, delete the comment. The goal is to document the knowledge that lives only in the author's head — the decisions, trade-offs, and context that the code cannot communicate on its own.
✅ Claude ✅ ChatGPT ✅ Gemini
23 API Reference Doc Generator Generate complete, developer-ready API reference documentation

API documentation that developers actually use has three things: clear endpoint descriptions, real request/response examples, and explicit error documentation. This generates all three in a format compatible with common API doc tools.

Act as a technical writer specialising in API documentation. Generate complete API reference documentation for the endpoints below.

API type: [REST / GraphQL / gRPC]
Output format: [Markdown / OpenAPI 3.0 YAML / JSON / plain structured docs]
Authentication: [describe how consumers authenticate — e.g. Bearer token in Authorization header]
Base URL: [e.g. https://api.example.com/v1]
Endpoints to document (paste route definitions, controller code, or describe each endpoint):
[paste here]

For each endpoint, generate:
1. Summary — one-sentence description of what the endpoint does
2. HTTP method and full path
3. Authentication required: yes/no and type
4. Path parameters — name, type, required, description
5. Query parameters — name, type, required, default, description
6. Request body schema — with field names, types, required/optional, constraints, and example
7. Success response — status code, schema, and concrete JSON example
8. Error responses — all possible error codes with description and example error body
9. Rate limiting notes (if applicable)
10. Code example in [language the caller is likely using — e.g. curl / Python / JavaScript]
Pro tip: The most important part of API documentation is the error responses section — and it's almost always the most neglected. Developers integrate against your errors, not just your happy path. Document every 4xx error with the specific condition that produces it and how the client should handle it.
✅ Claude ✅ ChatGPT ✅ Gemini
24 Technical Decision Record (ADR) Writer Document an architectural or technical decision with full context and trade-offs

Architecture Decision Records (ADRs) are the institutional memory that prevents the same debates from recurring every 18 months. This generates a well-structured ADR from your decision context — capturing what was decided, why, and what was rejected.

Act as a technical writer. Create a formal Architecture Decision Record (ADR) for the following technical decision.

Decision title: [short, descriptive title — e.g. "Use PostgreSQL over MongoDB for user data storage"]
Date: [today's date]
Status: [Proposed / Accepted / Deprecated / Superseded]
Decision made by: [team name or individual role — no personal names needed]

Context (describe the problem or situation that required a decision):
[describe why a decision was needed]

Decision (what was decided):
[describe what was chosen]

Options considered:
Option A: [name] — [brief description]
Option B: [name] — [brief description]
Option C (if applicable): [name] — [brief description]

Reasons for the chosen option:
[describe the key factors that drove the decision]

Reasons the other options were rejected:
[describe why each alternative was not chosen]

Consequences — positive:
[what this decision enables]

Consequences — negative or risks:
[what this decision makes harder or the risks it introduces]

Please format this as a standard ADR document in Markdown, including all sections above in a consistent structure that can be stored in a /docs/decisions/ folder in the repository.
Pro tip: Write ADRs at decision time, not retrospectively. The context, constraints, and rejected alternatives are vivid when the decision is fresh and nearly impossible to reconstruct accurately six months later. A 15-minute ADR written today saves hours of "why did we build it this way?" archaeology in the future.
✅ Claude ✅ ChatGPT ✅ Gemini
25 Onboarding Guide Creator Write a developer onboarding guide that gets new team members productive in one day

The average developer takes 3–6 months to become fully productive in a new codebase. A good onboarding guide compresses that timeline by providing the context, conventions, and environment setup that would otherwise be acquired through weeks of questions. This generates one from your description.

Act as a technical writer creating a developer onboarding guide. Generate a structured onboarding document that gets a new engineer productive within their first day.

Project or codebase: [name and brief description]
Tech stack: [languages, frameworks, databases, cloud services]
Local development setup (describe the steps or paste your setup script): [describe]
Key repositories and their purpose: [list them]
Coding conventions and style guide: [describe or link]
Branching and PR workflow: [e.g. feature branches, squash merge to main, PR template required]
How to run tests locally: [describe]
How to deploy to staging: [describe]
Key people to know for specific areas: [describe by role, not name — e.g. "database questions → the backend lead"]
Most common mistakes new engineers make: [describe 3–5 gotchas]
Glossary of internal terms, acronyms, or domain-specific concepts: [list them]

Generate an onboarding guide covering:
1. Welcome & system overview — what this system does and why it exists
2. Local environment setup — numbered, command-by-command
3. Codebase tour — key directories and what each contains
4. Workflow guide — how to pick up a ticket, branch, commit, PR, and deploy
5. How to run and write tests
6. Common gotchas and how to avoid them
7. Glossary
8. First-week checklist — specific tasks to complete in order
Pro tip: Have the newest engineer on your team review this guide after they join and mark every step where they got stuck or confused. Their friction map is your onboarding guide's first edit. The guide is only as good as the most recent person who used it — keep it a living document, not a one-time write.
✅ Claude ✅ ChatGPT ✅ Gemini

🧪 Testing Prompts (26–30)

These prompts generate comprehensive, immediately runnable tests — covering unit tests, edge cases, integration test strategies, coverage gap analysis, and TDD coaching. AI-generated tests are not a replacement for thinking about what your code should do, but they dramatically accelerate the mechanical work of writing test scaffolding and generating edge case scenarios.
26 Unit Test Suite Generator Generate a complete unit test suite for any function or class

Writing unit tests from scratch is mechanical work that AI does well. This generates a complete test suite covering happy paths, error paths, and boundary cases — in your specific testing framework, following your conventions.

Act as a senior engineer specialising in test-driven development. Generate a complete unit test suite for the code below.

Language: [e.g. Python, TypeScript, Java, Go]
Testing framework: [e.g. pytest, Jest, JUnit 5, Go testing, Vitest, RSpec]
Mocking library (if applicable): [e.g. unittest.mock, jest.mock, Mockito]
Code to test:
[paste the function or class here]
Any existing tests (to avoid duplication): [paste or describe]

Generate test cases covering:
1. Happy path — all expected inputs produce correct outputs
2. Edge cases — empty input, null/None, zero, empty string, empty array, maximum values
3. Error paths — invalid input types, out-of-range values, missing required fields
4. Boundary conditions — values at the exact limit of valid ranges
5. State — if the function modifies state, test before/after
6. Side effects — external calls that should or should not be made (use mocks)

For each test:
- Use a descriptive name following [describe/it / test_ / TestXxx] convention for [framework]
- Add a one-line comment explaining what the test verifies
- Structure tests with Arrange / Act / Assert pattern
- Mock all external dependencies (database, API calls, file system)

Return runnable test code — not pseudo-code.
Pro tip: After generating tests, run them immediately — before reading them carefully. Tests that don't pass (or don't run) tell you something about either the code or the test. Tests that all pass immediately on first run are sometimes too lenient. Look for tests that would fail if you introduced a deliberate bug.
✅ Claude ✅ ChatGPT ✅ Gemini
27 Edge Case & Boundary Test Designer Generate the edge cases your unit tests probably missed

Edge cases are where production bugs live. This prompt focuses exclusively on boundary analysis, adversarial inputs, and the combinations developers forget to test — producing the tests that catch bugs before users do.

Act as a test engineer specialising in boundary analysis and adversarial testing. Generate edge case and boundary test scenarios for the code below — focus on the inputs that would fail in production that developers typically miss.

Language / Framework: [e.g. Python / pytest]
Code to test:
[paste function or class]
Existing tests I already have: [paste or describe — so you don't repeat them]

Generate edge case scenarios across these categories:
1. Numeric boundaries — zero, negative, max int, min int, float precision issues, NaN, infinity
2. String inputs — empty string, whitespace-only, very long strings, special characters, unicode, null bytes, newlines
3. Collection inputs — empty list/array, single element, very large collections, duplicate values, None/null elements
4. Date and time — epoch, far-future dates, leap year February 29, timezone edge cases, DST transitions
5. Concurrency — what if this function is called simultaneously from two threads?
6. Adversarial inputs — SQL injection strings, script tags, path traversal sequences (../), excessively nested JSON
7. State — what if required state hasn't been initialised? What if it's been partially initialised?
8. Combinations — the interaction of two individually valid inputs that together cause unexpected behaviour

Return as runnable test cases in [framework], with a one-line comment on what each edge case is probing for.
Pro tip: The most valuable edge cases are the ones specific to your domain — not the generic ones. A payments function has different critical boundaries (negative amounts, amounts with more than 2 decimal places, currencies with zero minor units like JPY) than a string formatter. Tell the AI your domain and ask it to generate domain-specific edge cases.
✅ Claude ✅ ChatGPT ✅ Gemini
28 Integration Test Strategy Builder Design an integration test strategy for a multi-component system

Integration tests verify that components work together correctly — something unit tests, by design, cannot do. This designs an integration test strategy for your specific system, covering which integrations to test, how to test them, and what to mock vs use real implementations.

Act as a QA engineer and testing architect. Design an integration test strategy for the system described below.

System description: [describe your application — its components, external dependencies, and data flow]
Key integrations (list each pair of components that talk to each other): [e.g. API → database / API → third-party payment service / worker → message queue / frontend → backend API]
External services involved: [e.g. Stripe, SendGrid, AWS S3, a third-party REST API]
Testing environment available: [e.g. can spin up Docker Compose / have a staging environment / limited to CI/CD pipeline / local only]
Current test coverage level: [e.g. good unit tests, no integration tests / some integration tests / full coverage]

Please design:
1. Which integrations are highest priority to test and why — ranked by risk of failure and business impact
2. For each high-priority integration: the specific test scenarios to cover (not just happy path)
3. What to use real implementations for vs what to stub/mock — with justification
4. Test data strategy — how to set up and tear down state for each integration test
5. How to handle external services that can't be called in tests (payment providers, email services)
6. A recommended test structure — where integration tests live in the codebase and how they're run in CI
Pro tip: Use real databases in integration tests, not in-memory fakes. An SQLite database behaving differently from PostgreSQL in production has caused more integration test false positives than almost any other decision. Docker Compose makes running a real Postgres or MySQL in CI trivially easy — use it.
✅ Claude ✅ ChatGPT ✅ Gemini
29 Test Coverage Gap Analyser Identify what your existing tests are missing — and what to write next

High code coverage doesn't equal good tests — you can have 90% coverage and still miss critical behaviour. This analyses your existing tests against your code to identify meaningful gaps: untested branches, missing error paths, and uncovered business rules.

Act as a senior QA engineer. Analyse the gap between my existing tests and my code — identify what's missing, not just what's untested by line count.

Language / Testing framework: [e.g. Python / pytest, TypeScript / Jest]
Code under test:
[paste the code]
Existing tests:
[paste the test file]
Coverage report (if available — paste the output): [paste or describe]

Please analyse:
1. Untested code paths — branches (if/else), exception handlers, early returns that no test exercises
2. Untested business rules — logic that exists in the code but no test verifies it works correctly
3. Missing error path tests — exceptions that could be raised but no test verifies the handling
4. Weak assertions — tests that call the code but don't assert enough to catch a regression
5. Tests that test the wrong thing — tests so tightly coupled to implementation they'd break on refactor without any real behaviour change
6. Missing integration points — places where the code calls external dependencies that no test covers, even with mocking

Produce a prioritised list of test gaps to fill, with a one-sentence description of what each missing test should verify. Rank by: likelihood of a real bug hiding there.
Pro tip: Mutation testing (using tools like mutmut for Python or Stryker for JavaScript) automatically introduces small bugs and checks whether your tests catch them. Run it after using this prompt — the tests the AI suggests filling and the mutations that survive are often the same gaps. Mutation coverage is a more honest metric than line coverage.
✅ Claude ✅ ChatGPT ✅ Gemini
30 TDD Red-Green-Refactor Coach Write the failing test first — then implement just enough to pass it

Test-Driven Development is one of the highest-leverage practices in software engineering — but the discipline of writing the test before the code is hard to maintain without structure. This prompt coaches the TDD cycle for a specific feature, producing the red test first, then the minimal green implementation.

Act as a TDD coach. Guide me through the red-green-refactor cycle for a specific feature I'm building.

Language / Framework: [e.g. Python / pytest, TypeScript / Jest]
Feature I'm building: [describe what the code should do — in terms of behaviour, not implementation]
Interface I've decided on (function signature, class API, or REST endpoint): [describe or paste]
Any constraints on the implementation: [e.g. must use existing UserRepository class / must not call the database directly]

Please:

STEP 1 — RED (failing test):
Write the first, most important failing test for this feature. It should:
- Test one specific behaviour
- Fail for the right reason (not a syntax error — a genuine assertion failure)
- Be named to describe the behaviour it verifies

STEP 2 — GREEN (minimal implementation):
Write the minimum code that makes the test pass — not a complete implementation, just enough to go green. It can be ugly.

STEP 3 — NEXT TEST:
Write the next failing test that forces me to improve the implementation — adding the next important behaviour.

STEP 4 — REFACTOR prompt:
After the second test is green: suggest one refactor that improves the implementation without changing behaviour, and explain what makes it worth doing.
Pro tip: The "minimum code to make the test pass" step in TDD is the hardest discipline to maintain. The AI's "green" implementation often looks embarrassingly simple — a hardcoded return value, an if statement that only handles one case. That's correct TDD. The point is that the next test forces the real implementation. Trust the process.
✅ Claude ✅ ChatGPT ✅ Gemini

♻️ Refactoring & Clean Code Prompts (31–35)

These prompts guide safe, systematic refactoring — improving the internal structure of code without changing its external behaviour. Refactoring without a plan creates more debt than it clears. Each prompt here is structured to produce a step-by-step refactoring plan, not a rewrite from scratch.
31 Code Refactoring Planner Plan a safe, incremental refactoring of a messy function or module

A big-bang rewrite is almost always a mistake. Incremental refactoring — changing one thing at a time, with tests passing at each step — is how professionals improve code safely. This plans the refactoring sequence for your specific code.

Act as a senior engineer specialising in refactoring and code quality. Help me plan a safe, incremental refactoring of the code below — no big-bang rewrites.

Language: [e.g. Python, TypeScript, Java]
Code to refactor:
[paste code here]
What's wrong with it (in your own words): [describe the problems you see]
Existing test coverage: [describe — no tests / some unit tests / full coverage]
Risk level: [e.g. critical production path / used in many places / low-traffic feature / internal tool]

Please:
1. Identify the specific code quality problems — name them with recognised terms (long method, feature envy, primitive obsession, etc.)
2. Design a refactoring sequence — ordered steps from safest to most structural, each step leaving the code in a working state
3. For each step: describe what change is made, why it's an improvement, and what test I should run to confirm no behaviour changed
4. Identify which refactoring steps require new tests to be written first (before refactoring)
5. Flag any step that carries meaningful risk and explain how to mitigate it
6. Estimate the total effort — is this a 30-minute tidy or a 3-day project?
Pro tip: The rule for safe refactoring: never change behaviour and structure at the same time. Each commit should be either a behaviour change (adding/fixing a feature) or a structural change (refactoring). Mixing them makes it impossible to bisect a regression. One type of change per commit — always.
✅ Claude ✅ ChatGPT ✅ Gemini
32 Dead Code & Complexity Reducer Identify and remove dead code, unused imports, and accidental complexity

Dead code is a tax you pay in reading time every time someone works in the file. This prompt identifies code that can be deleted safely — and spots complexity that has accreted around a simple core, making the code harder to understand than the underlying logic requires.

Act as a code quality engineer. Audit the code below for dead code, unnecessary complexity, and things that can be safely removed or simplified.

Language: [e.g. Python, JavaScript, Go]
Code to audit:
[paste code here]

Please identify:
1. Dead code — functions, methods, or branches that are never called or never reached
2. Unused imports / dependencies — imported but never used
3. Commented-out code — old code blocks that should be deleted (not kept "just in case")
4. Redundant conditions — if/else branches that always evaluate the same way given how the function is called
5. Unnecessary abstraction — over-engineered patterns applied to problems that don't require them
6. Feature flags or config switches that are always on or always off — making one branch unreachable
7. Complexity that wraps simple operations — functions that could be one-liners

For each: confirm whether it's safe to remove (and how to verify), or whether it might be called from somewhere not shown. Provide the simplified version where appropriate.
Pro tip: "Delete first" is an underrated development practice. Before adding a feature, ask whether something can be removed first. Smaller codebases have fewer bugs, are faster to navigate, and require less cognitive load. The best code is the code you didn't write.
✅ Claude ✅ ChatGPT ✅ Gemini
33 Design Pattern Recommender Identify which design pattern solves your specific structural problem

Design patterns are solutions to recurring structural problems — but applying the wrong pattern creates more complexity than it solves. This prompt diagnoses your specific structural problem and recommends the pattern that solves it, with a concrete implementation example.

Act as a software design expert. Diagnose the structural problem in my code and recommend the most appropriate design pattern to address it.

Language: [e.g. Python, TypeScript, Java, Go]
The problem I'm experiencing (describe in plain English — not in pattern terminology):
[e.g. "I have a series of if/elif blocks that check the type of an object and call different processing functions — adding a new type requires touching 5 different places" / "I need to add behaviour to existing objects without modifying their classes" / "I have a complex object creation process that's scattered across many files"]
The current code (paste the problematic section):
[paste here]

Please:
1. Name the structural problem my code has — in design terms
2. Recommend the most appropriate design pattern to solve it — with a one-sentence justification
3. Show how the pattern applies to my specific code — not a generic textbook example, but my actual code rewritten with the pattern applied
4. Name any alternative patterns I considered and why they're less appropriate here
5. Flag the risk of over-engineering: is this pattern justified by the complexity I have, or would a simpler refactor achieve 80% of the benefit without the pattern overhead?
Pro tip: Always ask the AI to flag over-engineering risk. Patterns are solutions to problems that have grown complex enough to justify them. A Strategy pattern for two behaviours is overkill. A Strategy pattern for eight behaviours that are added weekly is exactly right. The right question isn't "which pattern fits?" but "is any pattern justified yet?"
✅ Claude ✅ ChatGPT ✅ Gemini
34 Legacy Code Modernisation Advisor Plan a safe upgrade path for old, brittle, or outdated code

Legacy code is any code you're afraid to change. The fear usually comes from a combination of poor test coverage, unfamiliar patterns, and unclear dependencies. This plans a systematic modernisation that reduces fear first, then improves the code.

Act as a software engineer with deep experience in legacy code modernisation. Help me plan a safe upgrade path for old or brittle code.

Language and current version: [e.g. Python 2.7 → 3.12, Node.js 12 → 20, Java 8 → 21]
Framework and current version: [e.g. Django 2.1, React 16, Spring Boot 2.3]
Code description (paste a sample or describe the major patterns used): [paste or describe]
Test coverage: [none / partial / good]
Business criticality: [e.g. core revenue path / internal tool / deprecated but still used]
Team capacity for this work: [e.g. 1 developer 20% time / full sprint allocation]
Hard deadline (if any): [describe or say "none"]

Please plan:
1. A characterisation strategy — how to understand what the code does before changing it (including adding tests without changing behaviour)
2. A dependency audit — which dependencies are blocking the upgrade, and are there maintained alternatives?
3. A phased modernisation plan — ordered steps from least risky to most structural
4. Breaking changes to plan for — what in the new version will require code changes
5. Quick wins — modernisations that deliver value immediately with low risk
6. The "never touch this" assessment — is any part of this code so risky it should be kept as-is and isolated rather than modernised?
Pro tip: Michael Feathers' rule for legacy code: before changing any code, get it under a characterisation test — a test that documents what the code actually does, not what it should do. This creates a safety net before you start modifying. The characterisation test often reveals surprising behaviour that the original developers intended but never documented.
✅ Claude ✅ ChatGPT ✅ Gemini
35 SOLID Principles Auditor Audit code against SOLID principles and identify violations with fixes

SOLID principles are the most useful set of object-oriented design guidelines for writing code that's easy to extend and maintain. This audits your code against each principle, identifies violations, and provides concrete fixes — not just labels.

Act as a software design coach. Audit the code below against the SOLID principles and identify violations with specific, actionable fixes.

Language: [e.g. Python, TypeScript, Java, C#]
Code to audit:
[paste class(es) or module here]

For each SOLID principle, please:
1. Assess whether the code satisfies or violates it
2. If violated: quote the specific code that violates it and explain why
3. Provide the corrected design — show the restructured code that satisfies the principle
4. Rate the severity of the violation: Minor (style issue) / Moderate (makes extension hard) / Severe (causes active pain when adding features)

SOLID Principles to assess:
S — Single Responsibility Principle: does each class have one reason to change?
O — Open/Closed Principle: is the code open to extension without modification?
L — Liskov Substitution Principle: are subtypes interchangeable with their base types?
I — Interface Segregation Principle: are interfaces focused and minimal?
D — Dependency Inversion Principle: do high-level modules depend on abstractions, not concretions?

End with: a prioritised list of which violations to fix first based on their actual impact on the codebase.
Pro tip: The most common and most impactful SOLID violation is the Single Responsibility Principle — classes or functions that do too many things. Fixing SRP violations almost always reveals natural seams for the other principles to follow. Start with SRP and the rest often resolves itself.
✅ Claude ✅ ChatGPT ✅ Gemini

⚡ Performance & Optimisation Prompts (36–40)

These prompts target specific, measurable performance improvements — SQL query optimisation, frontend load time, algorithmic complexity, memory management, and caching strategy. Optimise for the real bottleneck, not the theoretical one.
36 SQL Query Optimiser Optimise slow queries with indexes, rewrites, and execution plan analysis

Slow SQL queries are among the most common and most impactful performance bottlenecks in production. This prompt analyses your query, schema, and execution plan to produce a specific, tested optimisation — not generic "add an index" advice.

Act as a database performance engineer. Help me optimise a slow SQL query.

Database engine and version: [e.g. PostgreSQL 16, MySQL 8.0, SQLite 3.43]
The slow query (paste in full): [paste here]
Relevant table schema (paste CREATE TABLE statements): [paste here]
Current indexes on relevant tables: [list or paste]
Execution plan (paste EXPLAIN ANALYZE or EXPLAIN output if available): [paste here]
Row counts for relevant tables: [e.g. users: 500k rows, orders: 8M rows]
Current query execution time: [e.g. 4.2 seconds]
How often this query runs: [e.g. on every page load / once per minute / nightly batch]

Please:
1. Identify the primary performance bottleneck from the execution plan or schema (sequential scan, hash join on large table, missing index, etc.)
2. Propose an optimised query — with explanation of what changed and why
3. Recommend specific indexes to create — with the exact CREATE INDEX statement
4. Estimate the expected performance improvement after the optimisation
5. Flag any query rewrites that might change the result set in edge cases — so I can test carefully
6. Identify any schema changes (partitioning, denormalisation) that would help if query rewrites aren't sufficient
Pro tip: Always run EXPLAIN ANALYZE (PostgreSQL) or EXPLAIN FORMAT=JSON (MySQL) before and after the optimisation and paste both outputs into the follow-up prompt. The execution plan shows the query planner's actual strategy — not what you assumed it was doing. The difference between what you think the query does and what the planner actually does is where most query performance bugs hide.
✅ Claude ✅ ChatGPT ✅ Gemini
37 Frontend Performance Auditor Improve Core Web Vitals, bundle size, and rendering performance

Frontend performance directly affects user experience, SEO rankings, and conversion rates. This audit covers the full range of frontend performance levers — bundle size, rendering, Core Web Vitals, and loading strategy — for your specific stack and symptoms.

Act as a frontend performance engineer. Audit my frontend for performance issues and recommend specific, implementable improvements.

Framework / Tech stack: [e.g. React 18 / Next.js 14 / Vite, Vue 3 / Nuxt, vanilla JS]
Deployment: [e.g. Vercel, Cloudflare Pages, self-hosted Nginx, CDN details]
Current Core Web Vitals (if known):
- LCP (Largest Contentful Paint): [value or "unknown"]
- INP (Interaction to Next Paint): [value or "unknown"]
- CLS (Cumulative Layout Shift): [value or "unknown"]
Current bundle size (if known): [e.g. 1.2MB JS / 450KB gzipped]
Performance symptoms: [describe what users experience — slow initial load / sluggish interactions / layout shifts / slow time to interactive]
Relevant code (paste component, page, or build config if relevant): [paste here]

Please audit:
1. Bundle size — large dependencies, missing tree-shaking, duplicate packages
2. Code splitting — are routes and heavy components loaded lazily?
3. Image optimisation — format (WebP/AVIF), sizing, lazy loading, priority hints
4. Critical rendering path — render-blocking resources, font loading strategy
5. JavaScript execution — long tasks blocking the main thread, expensive re-renders
6. Caching strategy — cache-control headers, service worker, CDN caching
7. Network — unnecessary API calls, missing HTTP/2 or HTTP/3, lack of compression

For each issue: severity impact on Core Web Vitals, specific fix, and estimated improvement.
Pro tip: Run Lighthouse in Chrome DevTools in incognito mode (to exclude extensions) on both mobile and desktop before running this prompt. Paste the Lighthouse JSON report (Settings → Copy to clipboard) into the prompt — it gives the AI measured data on every performance category rather than requiring it to guess from symptoms.
✅ Claude ✅ ChatGPT ✅ Gemini
38 Algorithm Complexity Analyser Analyse Big-O complexity and find a more efficient algorithm

Algorithmic inefficiency is the most scalable performance problem — it gets exponentially worse as data grows. This analyses the time and space complexity of your code and recommends a more efficient alternative when one exists.

Act as a computer science and algorithms expert. Analyse the time and space complexity of my code and recommend improvements if a better algorithm exists.

Language: [e.g. Python, JavaScript, Java, Go]
Code to analyse:
[paste the function or algorithm]
Input characteristics: [e.g. sorted list / unsorted / large n (millions) / small n (always under 100) / graph with sparse edges / dense matrix]
Performance requirement: [e.g. must run in under 100ms / runs nightly as a batch / real-time with 50ms budget]

Please:
1. State the time complexity — Big-O for best case, average case, and worst case
2. State the space complexity — including any hidden allocations (recursion stack, intermediate collections)
3. Identify the bottleneck operation — the specific line or loop that dominates the complexity
4. If a more efficient algorithm exists: name it, explain it, and provide an implementation in my language
5. State the improved time and space complexity
6. Flag any trade-offs of the more efficient algorithm (e.g. harder to understand, requires sorted input, uses more memory)
7. If the current algorithm is already optimal for this problem: confirm it and explain why
Pro tip: Before optimising an algorithm, profile to confirm it's actually the bottleneck. O(n²) for n=100 is 10,000 operations — probably fine. O(n log n) for n=10,000,000 is 230 million — needs care. Know your actual n before investing in algorithmic optimisation vs simpler fixes like caching or indexing.
✅ Claude ✅ ChatGPT ✅ Gemini
39 Memory & Resource Leak Finder Identify memory leaks, unclosed resources, and retention issues

Memory leaks kill long-running processes — slowly at first, then catastrophically. Unclosed database connections, event listeners that accumulate, and references held past their useful life are the most common culprits. This finds them in your code.

Act as a systems engineer specialising in memory management. Identify memory leaks and resource management issues in my code.

Language / Runtime: [e.g. Python 3 / CPython, JavaScript / Node.js, Java / JVM, Go, C++]
Symptom: [e.g. memory grows continuously until OOM / process gets slower over 6+ hours / database connections exhausted / event loop overloaded]
How long the process runs before symptoms appear: [e.g. 2 hours / after 10k requests / after 3 days]
Code to analyse:
[paste the relevant section — e.g. request handler, background worker, event listener setup]

Please identify:
1. Unclosed resources — file handles, database connections, HTTP clients, sockets that may not be closed on all code paths
2. Growing collections — lists, maps, caches, queues that grow unboundedly without eviction
3. Event listener accumulation — listeners added but never removed, especially in loops
4. Circular references — objects that reference each other and prevent garbage collection
5. Long-lived references — objects captured in closures, class variables, or global state that should be short-lived
6. Language-specific memory issues for [language] — e.g. Python reference cycles, Node.js EventEmitter memory leaks, Java heap generation issues

For each finding: the specific code, why it leaks, and the fix including the correct resource cleanup pattern for my language.
Pro tip: For Node.js memory leaks, run the process with node --inspect and take heap snapshots in Chrome DevTools at startup, after 30 minutes, and after 60 minutes. Diffing the snapshots shows exactly which object type is growing. Paste the growing object names and counts into this prompt for a targeted diagnosis.
✅ Claude ✅ ChatGPT ✅ Gemini
40 Caching Strategy Advisor Design a caching layer that meaningfully reduces latency and backend load

Caching is one of the highest-leverage performance tools available — but a poorly designed cache creates staleness bugs, cache stampedes, and memory pressure. This designs a caching strategy appropriate to your specific data access patterns.

Act as a systems architect. Design a caching strategy for the bottleneck described below.

What's slow: [describe the operation — e.g. database query / external API call / computation / file read]
Current latency: [e.g. 800ms average]
How frequently this is called: [e.g. 200 times/second / once per user session / nightly batch]
Data freshness requirements: [e.g. must be real-time / eventual consistency OK / can be stale for up to 5 minutes / cache forever and bust on write]
Data size per cache entry: [rough estimate — e.g. 2KB JSON / 500 bytes / 50KB HTML fragment]
Infrastructure available: [e.g. Redis / Memcached / in-process memory / CDN / browser cache / none yet]
Cache invalidation trigger: [e.g. on write / TTL only / manual / no writes — read-only data]

Please design:
1. Recommended cache type and layer — where in the stack to cache (database query cache / application-level / HTTP cache / CDN / browser)
2. Cache key design — how to construct keys that are specific enough to avoid collisions and general enough for good hit rate
3. TTL strategy — how long to cache, and whether to use sliding expiration or fixed
4. Invalidation strategy — how to evict stale data when the source changes
5. Cache warming — should the cache be pre-populated, and how?
6. Cache stampede prevention — what happens when the cache expires and 1000 requests hit the backend simultaneously?
7. Monitoring — what metrics to track to know if the cache is working
Pro tip: Phil Karlton's maxim — "there are only two hard things in computer science: cache invalidation and naming things" — is still true. The invalidation strategy should be the first thing you design, not the last. A cache with a wrong invalidation strategy is worse than no cache — it serves wrong data confidently.
✅ Claude ✅ ChatGPT ✅ Gemini

🔐 Security Prompts (41–45)

These prompts approach your code and system from an adversarial perspective — identifying vulnerabilities that could be exploited before an attacker does. Each prompt targets a specific security domain: OWASP vulnerabilities, secrets management, dependency risk, authentication design, and threat modelling.
41 OWASP Security Checker Audit code against the OWASP Top 10 vulnerabilities

The OWASP Top 10 represents the most critical and most commonly exploited web application security risks. This audit checks your code against each category systematically, not just looking for the most obvious pattern.

Act as a web application security expert using the OWASP Top 10 (2021) as your audit framework. Check the code below for each category systematically.

Language / Framework: [e.g. Python / Django, PHP / Laravel, Node.js / Express, Ruby / Rails]
Code type: [e.g. API endpoint handler / authentication module / file upload handler / admin panel / user-facing form handler]
Authentication context: [e.g. public endpoint / authenticated users only / admin only]
Code to audit:
[paste code here]

Check each OWASP Top 10 category:
A01 – Broken Access Control: is authorisation enforced on every operation?
A02 – Cryptographic Failures: is sensitive data encrypted? Are weak algorithms used?
A03 – Injection: SQL, command, LDAP, XSS, SSTI injection vulnerabilities
A04 – Insecure Design: are there design-level flaws that can't be patched with code?
A05 – Security Misconfiguration: debug mode, default credentials, overly permissive CORS
A06 – Vulnerable Components: known-vulnerable libraries or frameworks in use
A07 – Identification and Authentication Failures: weak passwords, session management, MFA gaps
A08 – Software and Data Integrity Failures: unsigned updates, insecure deserialisation
A09 – Security Logging and Monitoring Failures: are security events logged?
A10 – Server-Side Request Forgery (SSRF): are user-supplied URLs fetched server-side?

For each finding: severity, the vulnerable code, the attack scenario, and the specific remediation.
Pro tip: Don't only audit new code. Schedule a quarterly OWASP audit on your highest-risk endpoints — authentication, payment processing, file uploads, and any endpoint that takes user input and does something with it server-side. OWASP vulnerabilities are often introduced gradually as code evolves, not all at once when it's written.
✅ Claude ✅ ChatGPT ✅ Gemini
42 Secrets & Credentials Auditor Find hardcoded secrets, credentials, and keys in code and configuration

Hardcoded secrets are the most common, most avoidable, and most frequently exploited source of data breaches. This audit identifies secrets in code and config, assesses their exposure risk, and designs the correct secrets management approach.

Act as a security engineer specialising in secrets management. Audit the code and configuration below for hardcoded credentials, exposed secrets, and insecure secrets handling.

Language / Stack: [describe]
Code / config to audit (replace any real values with [REDACTED] before pasting — I only need the structure):
[paste here]

Please identify:
1. Hardcoded secrets — API keys, passwords, tokens, private keys embedded directly in source code
2. Secrets in version-controlled config files — .env files committed to the repo, config.yaml with real values
3. Secrets in logs — code that logs request parameters, headers, or response bodies that may contain credentials
4. Secrets in error messages — exceptions that expose credentials in their message
5. Insecure secret handling — secrets stored in plain text in a database, passed as URL query parameters, stored in browser localStorage
6. Overly permissive access — credentials with broader permissions than the code requires

For each finding:
- Risk level (Critical / High / Medium)
- The pattern or code that exposes the secret
- The correct alternative (environment variable, secrets manager, vault, etc.)
- The immediate remediation if a real secret is currently exposed

Finish with: a recommended secrets management architecture for my stack.
Pro tip: Rotate any secret immediately after discovering it's been exposed — even if only in your local repository. You cannot know who has seen it. Then fix the root cause. The order matters: rotate first, fix second. Fixing the code doesn't help if the old secret is already compromised.
✅ Claude ✅ ChatGPT ✅ Gemini
43 Dependency Vulnerability Scanner Audit third-party dependencies for known CVEs and supply chain risks

The overwhelming majority of production applications run code written by unknown third parties. Known vulnerabilities in dependencies are the most mechanically exploitable class of security risk — because exploit code is publicly available the moment a CVE is published.

Act as a supply chain security engineer. Help me audit my third-party dependencies for known vulnerabilities and supply chain risk.

Package manager / ecosystem: [e.g. npm, pip, Maven, Cargo, Go modules, RubyGems]
Dependency file (paste package.json, requirements.txt, go.mod, Gemfile, pom.xml, or equivalent):
[paste here]
Vulnerability scan output (if available — paste npm audit, pip-audit, bundler-audit, or snyk output):
[paste or say "not run yet"]
Production vs development dependencies: [note which are dev-only if your file doesn't distinguish]

Please:
1. Review the dependency list for packages with known major security issues (based on your training knowledge — note these should be verified against current CVE databases)
2. Identify any packages that appear to be unmaintained, deprecated, or have had known supply chain incidents
3. Flag any packages pinned to very old versions where major security patches have likely been released
4. Identify transitive dependency risks — the packages most likely to pull in vulnerable sub-dependencies
5. Recommend a dependency audit process — which tools to run, how frequently, and how to integrate into CI
6. Suggest 3 dependency hygiene rules for my project going forward

Note: for accurate CVE data, always run npm audit, pip-audit, bundler-audit, or snyk test — I can interpret the output with you.
Pro tip: Run npm audit, pip-audit, or your equivalent right now if you haven't recently. Then paste the output into a follow-up prompt with this template. Dependency vulnerabilities are the one class of security issue where the fix (version bump) is often trivial — but only if you know about it. Make dependency scanning a CI gate, not a quarterly task.
✅ Claude ✅ ChatGPT ✅ Gemini
44 Auth & Authorisation Reviewer Review authentication and authorisation implementation for security flaws

Authentication (who are you?) and authorisation (what can you do?) bugs are the most impactful class of application security vulnerability. A single authorisation check missing from one endpoint can expose the entire dataset. This reviews both layers methodically.

Act as an application security engineer. Review my authentication and authorisation implementation for security vulnerabilities.

Framework / Language: [e.g. Node.js / Express / Passport.js, Python / FastAPI / JWT, Java / Spring Security]
Auth mechanism: [e.g. JWT with RS256 / session cookies / OAuth 2.0 / API keys / SAML]
User roles / permission model: [describe — e.g. admin/user/guest / RBAC with custom roles / no roles]
Code to review (paste auth middleware, login handler, and one example of an authorised endpoint):
[paste here]

Please review for:
AUTHENTICATION:
1. Password storage — hashing algorithm (bcrypt/argon2 required; MD5/SHA1 = critical vulnerability)
2. Session management — token expiry, rotation, revocation, secure/httpOnly flags
3. JWT vulnerabilities — algorithm confusion (none algorithm), weak secrets, missing claims validation
4. Brute force protection — rate limiting, account lockout
5. Credential stuffing resistance — breach detection, MFA support

AUTHORISATION:
6. Missing authorisation checks — endpoints that check authentication but not authorisation
7. IDOR vulnerabilities — can a user access another user's resources by changing an ID?
8. Privilege escalation — can a lower-privilege user gain higher-privilege access?
9. Horizontal privilege escalation — can a user of equal privilege access another user's data?
10. Authorisation bypass — edge cases where authorisation is skipped (e.g. OPTIONS requests, error paths)

For each finding: severity, the vulnerable code, the attack, and the fix.
Pro tip: The most common and most dangerous authorisation vulnerability is IDOR — Insecure Direct Object Reference. Test it manually: log in as user A, get a resource URL, log out, log in as user B, and try to access user A's resource URL. If it works, you have an IDOR. This is trivially exploitable and systematically overlooked in code review.
✅ Claude ✅ ChatGPT ✅ Gemini
45 Threat Modelling Assistant Systematically identify threats to a new feature or system before building it

Threat modelling is the practice of thinking about how a system could be attacked before building it — rather than discovering vulnerabilities in production. This applies the STRIDE framework to a new feature or system to surface threats that security review misses.

Act as a security architect. Run a STRIDE threat model on the feature or system I'm designing.

What I'm building: [describe the feature or system in detail — include data flows, user types, external integrations, and sensitive operations]
Who uses it: [describe user types and trust levels]
Data it handles: [describe the data — PII / financial / health / public data]
External systems it touches: [APIs, databases, message queues, cloud services]
Deployment environment: [cloud / on-premise / SaaS / mobile app]

Apply STRIDE — for each threat category, identify specific threats to my system:

S — Spoofing: how could an attacker impersonate a legitimate user or system component?
T — Tampering: how could data be modified in transit or at rest without detection?
R — Repudiation: how could a user deny performing an action they actually took?
I — Information Disclosure: how could sensitive data be exposed to unauthorised parties?
D — Denial of Service: how could availability be disrupted?
E — Elevation of Privilege: how could a user gain access they shouldn't have?

For each identified threat:
- Likelihood (High / Medium / Low) given my deployment context
- Impact (High / Medium / Low)
- Specific mitigation to implement before launch
- Monitoring or detection mechanism to add

Finish with: a prioritised list of the 5 most critical threats to address before shipping.
Pro tip: Threat modelling sessions are most effective when done with at least two people — one who built the feature and knows its design, and one who didn't and can ask "what happens if...?" questions without assumptions. The AI fills the role of the second person remarkably well. Run this prompt in a team session and discuss each finding together.
✅ Claude ✅ ChatGPT ✅ Gemini

🚀 DevOps & Developer Productivity Prompts (46–50)

These prompts support the engineering practices, workflows, and tools that surround the code itself — CI/CD pipeline design, Git workflow strategy, technical communication, interview preparation, and personal developer productivity. Great engineers are measured not just by the code they write but by how effectively they operate as part of a system.
46 CI/CD Pipeline Designer Design a robust, fast CI/CD pipeline for your stack and team

A slow or fragile CI/CD pipeline is a bottleneck that costs the entire engineering team — every day, on every commit. This designs a pipeline that balances thoroughness with speed, and reliability with simplicity, for your specific stack and deployment target.

Act as a DevOps engineer. Design a CI/CD pipeline for my project — optimised for speed, reliability, and developer experience.

Stack: [language, framework, test runner]
CI/CD platform: [e.g. GitHub Actions / GitLab CI / CircleCI / Jenkins / Bitbucket Pipelines]
Deployment target: [e.g. AWS ECS / Heroku / Vercel / Kubernetes / self-hosted VPS / serverless]
Current deployment process: [describe how you currently deploy — manual / existing pipeline]
Environments: [e.g. dev / staging / production / just prod]
Test suite: [describe — unit tests only / unit + integration / e2e with Playwright or Cypress]
Current pipeline time (if any): [e.g. 12 minutes / no pipeline yet]
Team size: [number of developers pushing code]

Please design:
1. Full pipeline configuration for [CI platform] — with actual YAML structure or equivalent
2. Stage breakdown — test / lint / build / security scan / deploy — with what runs in each
3. Parallelisation strategy — which stages can run concurrently to reduce total pipeline time
4. Caching strategy — dependencies, build artifacts, Docker layers
5. Environment promotion strategy — how code moves from commit to production safely
6. Failure handling — which failures should block deployment vs notify and continue
7. Estimated pipeline time for the designed pipeline
8. One quick win to implement first if the full pipeline is too much to build at once
Pro tip: Target a CI pipeline under 10 minutes. Pipelines over 10 minutes cause developers to context-switch to other tasks while waiting — which means bugs are discovered later, feedback is slower, and the pipeline becomes something people route around. Cache aggressively, parallelise ruthlessly, and cut test suites that are slow without providing proportional coverage value.
✅ Claude ✅ ChatGPT ✅ Gemini
47 Git Workflow & Branching Strategist Design a Git branching strategy and workflow for your team size and release cadence

The wrong branching strategy for your team size and release model causes merge conflicts, deployment confusion, and hotfix chaos. This designs a Git workflow calibrated to your specific team and release requirements — not a generic "use Gitflow" recommendation.

Act as a senior engineering manager and Git workflow expert. Design a branching strategy and Git workflow for my team and release cadence.

Team size: [number of engineers committing code]
Release cadence: [e.g. continuous deployment (multiple times per day) / weekly releases / monthly releases / on-demand / mobile app with app store releases]
Current Git pain points: [e.g. merge conflicts / unclear release branches / hotfix process is chaotic / long-lived feature branches / unclear what's in production]
Monorepo or polyrepo: [describe]
Environments: [e.g. dev / staging / production / feature environments]
Currently using: [e.g. Gitflow / trunk-based / no formal strategy / feature branches only]

Please design:
1. Recommended branching strategy — name it, describe it, and justify it for my specific team and cadence
2. Branch naming conventions — with examples for features, fixes, releases, hotfixes
3. Merge vs rebase policy — and where each applies
4. PR / merge request rules — required reviewers, CI gates, squash vs merge commit
5. Release process — how a feature goes from branch to production, step by step
6. Hotfix process — how to fix a production bug without disrupting in-progress development
7. The one current pain point this strategy specifically solves — and how

If my current approach is already appropriate: confirm it and suggest the one improvement that would have the most impact.
Pro tip: For teams deploying multiple times per day, trunk-based development with feature flags is almost always the right answer — not Gitflow. Long-lived branches are the primary cause of merge conflict pain and delayed integration bugs. The shorter the branch lifetime, the healthier the codebase. Feature flags let you merge incomplete features to trunk safely.
✅ Claude ✅ ChatGPT ✅ Gemini
48 Code Explainer for Non-Technical Stakeholders Translate technical decisions and code into plain language for business audiences

The ability to explain technical decisions to non-technical stakeholders is one of the highest-leverage engineering skills. This translates your code, technical decision, or engineering concept into clear, jargon-free language calibrated to a specific non-technical audience.

Act as a technical communicator. Translate the technical concept, decision, or code below into clear language for a non-technical audience.

Audience: [e.g. the CEO / product managers / a sales team / a client / a board member / a non-technical co-founder]
What they care about: [e.g. cost / risk / timeline / customer impact / competitive advantage]
Technical thing to explain (choose one):
  A) A piece of code: [paste it]
  B) A technical decision we made: [describe it]
  C) A technical problem we're experiencing: [describe it]
  D) Why something took longer than expected: [describe what happened]

Please produce:
1. A plain English explanation (2–3 paragraphs) — no jargon, no acronyms without explanation
2. An analogy that connects this technical concept to something from everyday business life
3. What this means for the audience specifically — in terms of cost, risk, timeline, or customer impact
4. What they need to decide or know as a result of understanding this
5. One question they're likely to ask — and the answer

Optional: a one-sentence executive summary suitable for a Slack message or email subject line.
Pro tip: Lead with business impact, not technical mechanics. Non-technical stakeholders don't need to understand how a database index works — they need to understand that "this change will make the checkout page 3 seconds faster, which based on our data should increase conversions by roughly 8%." Impact first, mechanism only if asked.
✅ Claude ✅ ChatGPT ✅ Gemini
49 Technical Interview Prep Coach Practice coding interviews, system design rounds, and behavioural questions

Technical interviews have a specific format, vocabulary, and performance style that's different from actual engineering work. This prompt coaches the full interview cycle — algorithm problems, system design, code review questions, and behavioural rounds — for a specific role and company tier.

Act as a senior engineering interviewer and interview coach. Prepare me for a technical interview loop.

Role I'm interviewing for: [e.g. Senior Backend Engineer / Staff Engineer / Frontend Engineer]
Company tier: [e.g. FAANG / Series B startup / mid-size tech company / financial services firm]
Interview rounds expected: [e.g. 1x coding / 1x system design / 1x code review / 2x behavioural]
My strongest areas: [describe — e.g. strong in Python and data structures / strong in system design / strong in backend APIs]
My weakest areas: [describe honestly]
Language I prefer for coding rounds: [e.g. Python, Java, TypeScript]
Days until interview: [number]

Please provide a targeted prep plan:

1. CODING ROUND: Give me 3 algorithm problems at the right difficulty level for this role, with hints if I get stuck. After I attempt one, critique my solution for correctness, time/space complexity, and interview communication style.

2. SYSTEM DESIGN: Give me one system design prompt appropriate for this role. Ask me clarifying questions as a real interviewer would. After I describe my design, provide structured feedback covering: requirements gathering, component design, scalability, trade-offs, and failure modes.

3. BEHAVIOURAL: Give me 5 behavioural questions likely for this role and tier. After I answer one, score it on the STAR framework and identify what I should strengthen.

4. STUDY PLAN: Given my timeline, what to study in what order to maximise readiness.
Pro tip: For system design practice, do the full round out loud — narrate your thinking as you would in the real interview. "Before I design anything, I want to clarify requirements..." AI models can evaluate both what you designed and how you communicated your thinking, which is what interviewers are actually scoring. Silent design followed by a final answer misses the most important preparation.
✅ Claude ✅ ChatGPT ✅ Gemini
50 Dev Productivity System Builder Design a personal developer workflow that maximises deep work and minimises context-switching

Developer productivity is largely an environment and workflow design problem — not a motivation problem. This designs a personalised developer workflow covering focus time, communication batching, task management, and tooling that reduces the cognitive overhead of engineering work.

Act as a developer productivity coach. Design a personal workflow system for a software engineer — optimised for deep work and minimum context-switching.

My role: [e.g. full-stack developer / backend engineer / tech lead / solo founder-engineer]
Team communication tools: [e.g. Slack / Teams / email / async Notion updates]
Expected responsiveness from my team: [e.g. real-time during business hours / async within 4 hours / I set my own schedule]
My biggest productivity killers right now: [e.g. Slack interruptions / unclear priorities / too many meetings / context-switching between projects / unclear requirements causing rework]
My current setup: [OS, editor, terminal, task management — describe your current tools]
My energy pattern: [morning person / afternoon person / slow start]
Meeting load: [how many meetings per week and when they're concentrated]

Design a developer workflow covering:
1. Daily structure — deep work blocks, communication windows, and a daily planning ritual
2. Task management system — how to capture, prioritise, and track engineering work without overhead
3. Interruption protocol — a specific policy for handling Slack/Teams during focus time
4. Context-switching recovery — what to do when you're forced off a task and need to return quickly
5. Development environment setup — 3 tooling or workflow improvements that would save the most time
6. Weekly engineering review — a 15-minute Friday practice that surfaces blockers before they become crises
7. One change to make today that will have the largest impact on deep work quality
Pro tip: The single highest-leverage developer productivity change for most engineers is scheduling a 2–3 hour uninterrupted morning block before Slack or email is opened. Research on software development consistently shows that complex programming tasks require 20+ minutes to enter deep focus — and a single notification resets the timer. Protect the morning block fiercely.
✅ Claude ✅ ChatGPT ✅ Gemini

✍️ How to Write Better Coding AI Prompts

The gap between a generic AI coding response and one that solves your actual problem comes down to four inputs. Every prompt in this library uses them — and every time you write your own, run this checklist.

📐 The Coding Prompt Formula:
[Role] + [Specific Code/Error Context] + [Concrete Output Format] + [Constraints]

Example: "Act as a Python debugging expert [Role]. This function receives a list of user IDs and returns their profiles from our PostgreSQL database, but throws a psycopg2 OperationalError after processing approximately 500 items [Context]. Return a diagnosis of the root cause and the minimal fix [Format], using only psycopg2 without adding new dependencies [Constraints]."
More accurate debugging responses when the full stack trace is provided vs just the final error line
40% Reduction in cognitive output quality from multitasking during coding — deep work protection is an engineering performance issue, not a preference
Average cost of finding a bug in production vs during code review — the review prompts in this guide exist to shift that cost left
⚠️ AI coding accuracy note: AI models have strong coverage of common patterns and well-documented libraries, but they can confidently produce incorrect code — especially for niche frameworks, recent API changes, or complex concurrency scenarios. Always: (1) understand the code the AI generates before using it, (2) run tests against it, (3) check any library API calls against current documentation. AI-generated code is a starting point, not a shipping artefact.

❓ Frequently Asked Questions

What are the best AI prompts for debugging code?

The best debugging AI prompts give the model your exact error message, the code snippet where the error occurs, what you expected to happen, and what actually happened. Generic prompts like "fix my code" produce generic advice. Prompts 1–7 in this guide use a structured diagnostic format covering root cause analysis, error message decoding, runtime performance, logic errors, environment issues, async bugs, and rubber duck debugging — all with bracket placeholders for your specific context.

Can AI do a useful code review?

Yes — AI code reviews are most useful when you specify the review lens: security, performance, readability, or architecture. A prompt that says "review my code" produces surface-level observations. Prompts 8–13 in this guide direct the AI to review against specific criteria — OWASP vulnerabilities, Big-O complexity, naming conventions, PR readiness, and anti-pattern detection — producing targeted, actionable feedback rather than generic style comments.

How do I use AI for software architecture decisions?

AI architecture prompts work best when you provide system requirements, expected scale, team constraints, and the specific trade-offs you're trying to resolve. Prompts 14–20 in this guide cover system design, microservices decomposition, database schema design, API design review, scalability planning, tech stack selection, and architecture trade-off analysis — each structured to produce a reasoned recommendation rather than a generic pattern list.

What AI prompts generate the best technical documentation?

The most effective documentation AI prompts specify the audience (developer, end user, non-technical stakeholder), the document type (README, API reference, ADR, onboarding guide), and the key information to cover. Prompts 21–25 in this guide produce production-ready documentation for each format — including README structure, inline comment style, OpenAPI-compatible API references, Architecture Decision Records, and developer onboarding guides.

Can ChatGPT or Claude help write unit tests?

Yes. AI is particularly strong at generating unit tests, edge case scenarios, and integration test strategies when given the function signature, expected behaviour, and testing framework. Prompts 26–30 in this guide cover the full testing cycle: unit test generation, edge and boundary case design, integration test strategy, coverage gap analysis, and TDD coaching — all structured to work with your specific language and framework.

How do I use AI to improve code security?

Security-focused AI prompts should specify the OWASP Top 10 category, the language and framework in use, and whether the review is for authentication, data handling, or dependency risk. Prompts 41–45 in this guide cover OWASP vulnerability checking, secrets and credentials auditing, dependency vulnerability analysis, auth and authorisation review, and threat modelling — each structured to produce specific, remediable findings rather than general security advice.

Are these coding AI prompts suitable for all programming languages?

Yes. Every prompt in this guide uses bracket placeholders where you specify your language, framework, and codebase context. A Python data engineer debugging a Pandas pipeline and a TypeScript developer reviewing a Next.js PR use the same prompt structure — the brackets you fill in define the language-specific output. AI models like Claude and GPT-4o have strong coverage across Python, JavaScript, TypeScript, Java, Go, Rust, SQL, and most other mainstream languages.

📚 Related Guides on IndexCraft
AI Prompts · Productivity · Planning 50 Best AI Prompts for Productivity & Personal Organisation 2026

Daily planning, habit building, time management, goal setting, and focus prompts — the ideal companion to this coding productivity guide.

Read Productivity Prompts →
💼
AI Prompts · Career · Job Search 50 Best AI Prompts for Career & Job Search 2026

Resumes, cover letters, LinkedIn, technical interview prep, and salary negotiation prompts — pairs directly with Prompt 49 in this guide.

Read Career & Job Search Prompts →
📣
AI Prompts · Marketing & SEO · 2026 50 Best AI Prompts for Marketing & SEO 2026

Campaign strategy, social media, email, paid ads, and analytics prompts — for developers building or advising on marketing technology.

Read Marketing & SEO Prompts →
🤖
GEO · AEO · AI Search · 2026 GEO & AEO Complete Guide 2026

How to optimise for AI Overviews, ChatGPT, Perplexity, and LLM-powered search — essential for developers building or advising on content platforms.

Read GEO & AEO Guide →