Each prompt states what done looks like, the check that proves it and a turn bound, so Claude can work through it on its own. Replace the parts in square brackets with your own paths and commands. 10 are free, Pro includes all 32.
securityFreeruns for about €0.70 of usageabout 15 minSonnet 5.5
Finds keys and tokens in the repo, moves them to environment variables and blocks new ones.
/goal no API key, token, password or private key is hard-coded in tracked files. Search with `git grep -nE` for long random-looking strings, private key headers and names like key, secret, token and password with a literal value, and show the search and its results. Move each real secret to an environment variable read at startup with a clear error when missing, add the names with placeholder values to .env.example, and make sure .env is in .gitignore. To prove it: run the same `git grep -nE` search again and show it has no real secrets left, and run `npm test` and show it exits 0. Constraints: never print a secret value in the conversation (show only the file, line and variable name), do not rewrite git history, and list every secret that must be rotated because it was committed. Or stop after 15 turns.
securityProruns for about €1.00 of usageabout 20 minSonnet 5.5