Claude Skills by alyanhaider

Use this skill whenever designing or modifying API routes/endpoints, choosing between REST/GraphQL/tRPC, deciding HTTP verbs or status codes, shaping success/error JSON responses, adding pagination, validating request input, versioning an API, or writing error handling and logging code. Trigger on requests like "add an endpoint for X," "what status code should this return," "my API responses look inconsistent," "how should I handle this error," "set up logging," or "why is this query slow" (N...

Use this skill whenever building or modifying login, signup, logout, password reset, session handling, token storage, "remember me" behavior, protected routes, or "Login with Google/GitHub" (OAuth) flows. Trigger on requests like "add auth," "protect this route," "add login with Google," "users keep getting logged out," "how should I store the token," or any question about JWT, sessions, cookies, or password hashing. This is the single most common place an AI coding agent introduces a securit...

Detailed rules for building a clean, maintainable backend — covering the routes/controllers/services/models layer pattern, third-party service integration structure, environment variable management, middleware design, and how to tell Cursor to build each layer correctly. Use this skill whenever the user is building a backend, adding an API endpoint, integrating a third-party service (Stripe, OpenAI, SendGrid, Cloudinary, etc.), asking how backend code should be organized, or asking why their ...

Use this skill whenever adding caching (Redis, HTTP cache headers, or any "don't recompute this every time" logic), or whenever work needs to happen outside the HTTP request cycle — sending emails, generating PDFs/exports, processing images, calling AI APIs, scheduled/recurring tasks, or anything a user shouldn't have to wait on synchronously. Trigger on requests like "this is slow," "cache this," "send an email after signup," "this export takes too long," "run this every night," or "the data...

ALLOWED_ORIGINS=https://writingplanner.com,https://www.writingplanner.com Now your CORS is controlled entirely by an environment variable — no code changes when you add a new frontend domain. Common CORS Blunders AI Makes Blunder 1: * with cookies javascript// AI's broken version — cookies never work app.use(cors({ origin: '*', credentials: true })) // Browser ignores credentials: true when origin is * // httpOnly cookies silently fail to send // Users appear logged out on every request Blund...

npx knex migrate:make add_users_table Every change to the DB goes through a migration file. You run them in sequence. Every environment stays identical. Blunder 2: No Indexes on Queried Columns What AI does: Creates tables with columns but never adds indexes. Why it breaks: Works fine with 100 rows. At 100,000 rows, every search query scans the entire table. The app slows to a crawl. What to do: Add indexes on every column you filter or sort by. sql-- Always index foreign keys CREATE INDEX id...

Use this skill whenever building or modifying any feature that accepts file uploads — images, avatars, PDFs, documents, exports, or any user-supplied binary data. Trigger on requests like "let users upload a profile picture," "add file attachments," "store generated PDFs," "users can export and download X," or any mention of Cloudinary, S3, Supabase Storage, or multer. File upload endpoints are one of the most commonly attacked surfaces on a web app, so trigger proactively any time an upload ...

How to find and fix the most common database and backend performance problems — covering the N+1 query problem, indexes, database connection pooling, slow query analysis, and what happens to your app when traffic spikes. Use this skill whenever the user asks about app performance, slow queries, database optimization, why their app slows down at scale, or mentions "N+1". Also trigger for phrases like "app is getting slow", "database is slow", "too many queries", "query optimization", "connecti...

How to structure any frontend or backend project from scratch — including multi-tool frontends, feature-based folder layouts, shared components, and backend layer separation. Use this skill whenever the user is starting a new project, adding a new feature, asking where a file should go, asking how to organize folders, asking about project architecture, or whenever Cursor/AI is about to create files and folders. Also trigger when the user says things like "how should I structure this", "where ...

The Fix: Always Scope Queries to the Logged-In User javascriptasync function getProject(req, res) { const project = await Project.findById(req.params.id, req.user.id) // Only returns project if it belongs to this user if (!project) return res.status(404).json({ error: 'Not found' }) res.json(project) } // In the model: async findById(id, userId) { const result = await db.query( 'SELECT * FROM projects WHERE id = $1 AND user_id = $2', [id, userId] // Must match BOTH id and user_id ) return r...