Scan code and git history for hardcoded secrets (API keys, tokens, passwords) and remove them. Use before committing, in CI, and on any repo handoff.

Handle errors explicitly — typed/structured errors, no bare except, fail loud with context, and convert exceptions at boundaries. Use when writing or reviewing code that touches I/O, networks, or user input.

Use when delegating work to agents or colleagues — craft briefs with machine-checkable done criteria, negative constraints, scope boundaries, and artifact expectations so acceptance is never a judgment call.

Use when auditing dependencies for security issues — run pip-audit/npm audit/osv-scanner, triage by reachability and severity, and upgrade or pin without breaking the build.

Split a large change into small, reviewable, individually-committed diffs so reviewers (human or agent) can follow intent. Use before opening a PR or when a PR is too big to review.

Write docstrings and comments that explain *why* and *contract*, not what the code visibly does. Use when adding public functions or clarifying non-obvious logic.

Use when a test passes sometimes and fails sometimes — classify the flakiness cause (state, time, order, network, parallelism), reproduce in a loop, and fix at the root instead of retrying.

Use when pinpointing which commit introduced a bug — full git bisect workflow from start/reset through automated bisect run scripts.

Report blockers, failures, and uncertainty truthfully instead of fabricating results or glossing over errors. Use whenever something didn't work or you're unsure.

Implement in the smallest possible working slice, then verify each slice with a test or a run before moving on. Use for any non-trivial implementation to avoid big-bang breakage.