Markdowners

How to receive any provider's webhooks safely: signature verification, idempotent processing, fast acknowledgment, and ordering assumptions.

Rules for producing translations that are faithful and natural at once: register, glossary discipline, false friends, locale formatting, and what to leave untranslated.

A pragmatic testing pyramid and CI discipline focused on tests that actually catch real regressions, not coverage-number theater.

Stripe-specific integration rules on top of payment-system-basics: key handling, Elements, SCA/3DS, and treating webhooks as the source of truth.

Keeping an established session safe for its whole lifetime: cookie flags, revocation, CSRF defenses, and concurrent-session visibility.

The baseline technical and content rules that make pages crawlable, indexable, and worth ranking, before any advanced SEO tactic.

Mobile-first layout rules for interfaces that hold up from a 360px phone to a 1920px desktop without horizontal scroll or broken touch targets.

Which endpoints need explicit abuse budgets, how to choose limits per identity axis, and how to respond to breaches without leaking exploitable detail.

The extra bar template-generated pages must clear: genuine per-page uniqueness, real underlying data, and crawl-budget-aware scale.

PostgreSQL-specific conventions on top of database-design-basics: naming, precise types (citext/jsonb/timestamptz), and RLS basics.

PHP + MySQL conventions on top of database-design-basics: prepared statements, utf8mb4, InnoDB, and PHP's shared-nothing request lifecycle.

PayPal-specific order/capture rules on top of payment-system-basics: server-side capture verification, idempotency, and sandbox testing.

Foundational rules for handling money safely: server-side pricing authority, idempotent charges, integer currency math, and staying out of PCI scope.

The OAuth/social-login handshake done correctly: PKCE, state validation, safe token handling, and account-linking without takeover risk.

App Router conventions: server-vs-client component defaults, safe env-variable exposure, and where data fetching and mutations belong.

How to change a live schema safely: backward-compatible rollout steps, no same-migration drops, and lock-aware changes on large tables.

The exact meta, Open Graph, and Twitter Card tags every public page needs, and how to generate them correctly for dynamic pages.

A capture format for meeting notes that separates decisions from actions from open questions, so notes are usable minutes rather than a transcript nobody rereads.

Rules for writing LinkedIn posts that actually get read: the first-two-lines hook, length bands, formatting, hashtag discipline, CTAs, and repurposing long content.

How to structure image-generation prompts that produce consistent, controllable results: subject/style/composition/lighting, negative prompts, iteration, and an ethics note on artist names.

How to validate forms so errors are clear, input is never lost, and client-side checks never substitute for real server-side validation.

How to fail loudly in development, gracefully in production, and always leave a diagnosable trail instead of a silent or generic failure.

Rules for keeping credentials out of git, out of client bundles, and rotatable — so a leak is an inconvenience, not a breach.

Rules for turning a transcript or video into broadcast-quality English subtitles: SRT/VTT formatting, line length, reading speed, timing, and punctuation conventions.

The email+password login flow specifics built on auth-fundamentals: signup verification, login timing safety, and password-change session rules.

Rules for summarizing a document or multiple sources faithfully: length targets, fidelity to the source, structure, and exact preservation of numbers and quotes.

Schema fundamentals that prevent the expensive-to-fix mistakes: keys, constraints, normalization, correct types, and indexing discipline.

Core authentication rules every login system needs: password hashing, session revocation, verification, and the line between authentication and authorization.

How an AI coding agent should behave in a real codebase: ask before destructive actions, stay in scope, never fabricate, and know when to stop.

Baseline accessibility rules — semantic HTML, keyboard operability, contrast, and screen-reader support — built in from the first component.

E-commerce checkout context

The rules an AI agent needs to build a safe, accessible checkout flow: payments, Stripe, webhooks, form UX, error handling, sessions, and accessibility.

SaaS starter context

Everything a new SaaS codebase needs on day one: project conventions, auth, database, testing, error handling, secrets, and SEO basics.