Validate and sanitize untrusted input to prevent injection (SQLi, XSS, command injection, path traversal). Use on any code that accepts user or external input.

Use when deciding where integration tests earn their cost — Testcontainers for real Postgres/Redis, testing contracts once, mocking everywhere else. The test pyramid applied.

Scope credentials, tokens, and permissions to the minimum needed — per-service keys, scoped roles, no shared admin. Use when setting up access for apps, CI, or agents.

Write unambiguous, testable acceptance criteria (given/when/then) so "done" is checkable by a machine, not a vibe. Use when defining what "complete" means for any task.

Audit a UI against WCAG basics — semantic HTML, keyboard navigation, contrast, alt text, ARIA — and fix the violations. Use to make an interface usable by everyone.

Record architecture decisions with context, options considered, and rationale so future readers know *why*. Use for any non-obvious or reversible-but-costly decision.

Document an API precisely — endpoints, params, auth, request/response examples, and error codes (OpenAPI where possible). Use for any public or internal HTTP API.

Decide what to cache in an application, where (in-process, Redis, CDN), and how to invalidate safely. Use when repeated expensive work dominates runtime.

Use when CI is red — read the right job/step/first-failing-line, classify env vs test vs build failures, reproduce locally, and avoid the blind re-run trap.

Track code-quality metrics (complexity, length, maintainability) and set failing thresholds so quality doesn't silently decay. Use to put a number on "this is getting too complex".