Best Practices Prompts

# Linux Server Hardening taste of a careful operations engineer
- Build servers from a minimal base image and install only the packages a role needs, removing compilers and debugging tools from production hosts. Confidence: 0.85
- Manage every server with configuration as code (Ansible, cloud-init or an image pipeline) and never rely on manual changes that drift. Confidence: 0.90
- Disable SSH password authentication and root login, and allow only key-based or certificate-based logins. Confidence: 0.95
- Prefer short-lived SSH certificates or an identity-aware access proxy over long-lived authorized_keys files copied around. Confidence: 0.75
- Give each engineer a named account with sudo through groups, and never share a common admin user. Confidence: 0.90
- Default the host firewall to deny inbound traffic and open only the ports the service actually listens on. Confidence: 0.90
- Keep SSH and admin interfaces off the public internet, reachable only through a VPN, bastion or private network. Confidence: 0.85
- Enable unattended security updates for the base OS, and schedule reboots so kernel patches actually take effect. Confidence: 0.85
- Run each service as its own unprivileged system user with no login shell. Confidence: 0.90
- Use systemd sandboxing options such as `ProtectSystem=strict`, `NoNewPrivileges=yes` and `PrivateTmp=yes` for every long-running service. Confidence: 0.80
- Keep SELinux or AppArmor in enforcing mode and write a policy exception instead of disabling it when something breaks. Confidence: 0.75
- Ship logs, including auth and audit logs, to a central store so an attacker on the host cannot erase the trail. Confidence: 0.90
- Enable `auditd` rules for privileged commands, changes to sudoers and edits under `/etc`. Confidence: 0.70
- Keep secrets out of files in the repo and on disk where possible; fetch them at runtime from a secrets manager with scoped access. Confidence: 0.85
- Mount `/tmp` and data volumes with `noexec`, `nosuid` and `nodev` wherever the workload allows it. Confidence: 0.65
- Apply sysctl hardening such as disabling IP forwarding and ICMP redirects on hosts that are not routers. Confidence: 0.70
- Rate-limit authentication attempts with fail2ban or the platform equivalent on any exposed login service. Confidence: 0.70
- Encrypt disks at rest and protect backups with separate credentials that the server itself cannot use to delete them. Confidence: 0.85
- Scan hosts regularly against a CIS benchmark or similar baseline and track findings like any other bug. Confidence: 0.75
- Prefer replacing a compromised or drifted server with a freshly built one over trying to clean it in place. Confidence: 0.90
- Keep accurate time with NTP or chrony on every host so logs, certificates and tokens line up. Confidence: 0.80

# Tailwind CSS taste of a utility-first UI engineer
- Configure design tokens (colors, spacing, radii, fonts) once in the Tailwind theme and never hardcode hex values or arbitrary pixel sizes in markup. Confidence: 0.90
- Prefer theme-scale utilities over arbitrary values like `w-[437px]`; treat each arbitrary value as a missing token to add or a design to question. Confidence: 0.85
- Extract repeated utility groups into components (React, Vue, Svelte) rather than `@apply` classes in CSS files. Confidence: 0.85
- Reserve `@apply` for styling third-party markup or CMS content you cannot add classes to. Confidence: 0.75
- Use `prettier-plugin-tailwindcss` so class order is automatic and never argued about in review. Confidence: 0.95
- Build class names from complete static strings; never concatenate fragments like `text-color-500`, because the scanner cannot see them. Confidence: 0.95
- Use `clsx` plus `tailwind-merge` (or a `cn()` helper) so component props can override default classes without conflicts. Confidence: 0.85
- Model component variants with a typed variant helper such as `cva` instead of long ternary chains in `className`. Confidence: 0.80
- Write mobile-first: unprefixed utilities are the base and `sm:`, `md:`, `lg:` only add changes for wider screens. Confidence: 0.90
- Use container queries (`@container`, `@md:`) for reusable components whose layout depends on their slot, not the viewport. Confidence: 0.70
- Implement dark mode with CSS variables behind semantic color names like `bg-surface` and `text-muted`, rather than sprinkling `dark:` on every element. Confidence: 0.80
- Always style keyboard focus with `focus-visible:` rings and never remove outlines without a visible replacement. Confidence: 0.95
- Use the `typography` plugin's `prose` classes for long-form rendered Markdown instead of hand-styling every tag. Confidence: 0.80
- Keep `content`/source paths tight so builds stay fast and unused utilities never ship. Confidence: 0.85
- Use `group-*` and `peer-*` variants for parent and sibling state instead of adding JavaScript for hover or checked styles. Confidence: 0.75
- Respect `motion-reduce:` for animations and keep transitions short, around 150 to 200 ms. Confidence: 0.80
- Split a class list over several lines or into a variant object once it passes roughly 10 to 12 utilities. Confidence: 0.65
- Keep spacing on a consistent scale and use `gap-*` on flex and grid parents instead of margins on children. Confidence: 0.85
- Avoid `!important` modifiers except to override third-party styles you cannot change. Confidence: 0.80
- Document the token palette and the core components in Storybook or a styleguide page so designers and developers share one vocabulary. Confidence: 0.70

# Tokio Async Rust taste of a production service engineer
- Use `#[tokio::main]` only in the binary and keep library crates runtime-agnostic where practical, taking futures and handles as inputs. Confidence: 0.80
- Never block the async runtime; move CPU-heavy or blocking I/O work to `spawn_blocking` or a dedicated thread pool. Confidence: 0.95
- Use `tokio::sync::Mutex` only when a lock must be held across an `.await`; otherwise use `std::sync::Mutex` or `parking_lot` for short critical sections. Confidence: 0.90
- Prefer message passing with bounded `mpsc` channels over shared mutable state, and size every channel deliberately for backpressure. Confidence: 0.85
- Never use unbounded channels in request paths, because a slow consumer turns into unbounded memory growth. Confidence: 0.85
- Put a timeout on every network call with `tokio::time::timeout` or a client-level setting; no await on the network should be able to hang forever. Confidence: 0.95
- Use `JoinSet` or `TaskTracker` to own spawned tasks so they are awaited, cancelled and their errors are observed. Confidence: 0.85
- Treat every `.await` as a possible cancellation point and keep state consistent if the future is dropped there. Confidence: 0.85
- Use `select!` carefully and only with cancel-safe branches; document why each branch is safe to drop. Confidence: 0.80
- Implement graceful shutdown with a `CancellationToken` passed to every long-running task, plus a drain deadline. Confidence: 0.90
- Use `thiserror` for library error enums and `anyhow` (or `eyre`) with context in binaries. Confidence: 0.85
- Instrument with `tracing`, using `#[instrument(skip_all, fields(...))]` on handlers and structured fields instead of formatted strings. Confidence: 0.90
- Build HTTP services on `axum` with `tower` middleware for timeouts, concurrency limits, tracing and request IDs. Confidence: 0.80
- Share application state through an `Arc<AppState>` holding pools and clients, not through global statics. Confidence: 0.85
- Reuse one `reqwest::Client` and one database pool per process instead of creating them per request. Confidence: 0.95
- Bound concurrency for fan-out work with a `Semaphore` or `buffer_unordered(n)` rather than spawning a task per item. Confidence: 0.85
- Avoid holding guards or non-`Send` values across `.await`; let the compiler's `Send` errors guide the code toward a cleaner structure. Confidence: 0.75
- Test async code with `#[tokio::test]` and control time with `start_paused = true` instead of real sleeps. Confidence: 0.80
- Use `tokio-console` or runtime metrics when debugging stalls, before guessing at the cause. Confidence: 0.65
- Keep tokio feature flags minimal in libraries and enable `full` only in binaries or tests. Confidence: 0.70

# Secrets Management taste of a security-minded platform engineer
- Never commit secrets to git, including in tests, examples or old branches; treat any secret that touched a repo as compromised and rotate it. Confidence: 1.00
- Run secret scanning (gitleaks, trufflehog or the platform's built-in scanner) as a pre-commit hook and in CI on every push. Confidence: 0.90
- Keep a committed `.env.example` with names and dummy values, and gitignore every real `.env` file. Confidence: 0.90
- Store production secrets in a dedicated manager such as Vault, AWS Secrets Manager, GCP Secret Manager or 1Password, never in wikis or chat. Confidence: 0.95
- Prefer short-lived, workload-issued credentials (OIDC federation, IAM roles, Vault dynamic secrets) over long-lived static keys. Confidence: 0.90
- Use OIDC from CI to cloud providers instead of storing cloud access keys as CI secrets. Confidence: 0.90
- Scope every credential to one service, one environment and the least privilege it needs. Confidence: 0.95
- Never share secrets between staging and production, so a leak in one cannot unlock the other. Confidence: 0.95
- Inject secrets at runtime through the platform (mounted files or environment variables) rather than baking them into images or build artifacts. Confidence: 0.90
- Prefer mounted secret files over environment variables for highly sensitive values, since env vars leak into crash dumps, child processes and debug pages. Confidence: 0.70
- Automate rotation on a schedule and design apps to reload credentials without a redeploy. Confidence: 0.80
- Support two valid versions of a secret during rotation so it can happen without downtime. Confidence: 0.80
- Redact secrets in logs, traces and error reports with explicit filters, and test that the redaction works. Confidence: 0.90
- Use envelope encryption with a KMS for application-level encryption keys and keep the key-encryption key out of the app. Confidence: 0.80
- Encrypt secrets that must live in git (for example GitOps manifests) with SOPS or Sealed Secrets, never as plain Kubernetes Secrets. Confidence: 0.85
- Audit-log every secret read and alert on unusual access patterns. Confidence: 0.75
- Maintain a written revoke-and-rotate runbook for each critical credential so a leak response takes minutes, not days. Confidence: 0.85
- Give humans access through SSO and time-limited elevation instead of shared admin passwords. Confidence: 0.90
- Validate required secrets at startup and fail fast with a clear message that names the missing key but never prints its value. Confidence: 0.85
- Do not roll your own encryption or token formats; use well-reviewed libraries and the provider's primitives. Confidence: 0.95