Stop blind vibe coding.
The AI writes the code. You still have to know what to ask it for. 47 blocks, one page each, in plain words.
You don't just read this book.
You paste it into your AI.
Every block is one page. Every page has the same three parts. Find the block you need, read it in a minute, hand the last line to Claude Code, Cursor, or whatever you build with.
-
1
A diagram you get in five seconds.What the thing is, drawn. The password goes one way into a hash and never comes back.
-
2
A plain-language explanation.No jargon without a definition, no code you have to already understand.
-
3
TELL THE AI.The exact prompt to send: “Am I hashing passwords correctly (algorithm, salt, work factor)? Review my auth storage.” Paste it as-is. That sentence is the block.
47 blocks in 11 parts
They come in the order you meet them in a real project. Plan it, set it up, build it, store the data, lock the doors, keep it standing, ship it. Every block below is one page in the book.
Plan before you build
Deciding what you're building before you ask the AI to build it.
- 01Plan first Write the spec before the code
- 02MVP Ship the smallest useful version first
Set up the project right
Version control, locked dependencies, and secrets out of your code.
- 03Git Version control, rewind any change
- 04Lockfiles Pin exact versions so installs match everywhere
- 05venv Each project, its own package box
- 06Env vars Keep settings out of your code
- 07Secrets Keep them out of code, git, and logs
Build with AI
Make the AI remember your decisions and follow your rules.
- 08CLAUDE.md The rules file the AI reads every session
- 09Agent memory Facts the AI keeps across sessions
- 10Skills Package a procedure the AI can run
Keep the code clean
Two habits that keep a project from becoming a tangle you're afraid to touch.
- 11Modularity Small files that each do one job
- 12Separation Keep UI, logic, and data apart
Data: store it well
Where your app's information lives, how it's shaped, and how to change it safely.
- 13JSON Structured data any system can read
- 14SQL Ask a database for exactly what you want
- 15Data modeling Design your tables and how they link
- 16Migrations Versioned schema changes, in order
- 17Transactions All steps save together, or none do
- 18Indexing Jump to the rows instead of scanning
- 19N+1 queries Don't fire one query per row
- 20NoSQL MongoDB, and data that won't fit a table
Lock the doors
The holes attackers go looking for, and the blocks that shut them.
- 21TLS The padlock behind HTTPS
- 22Input validation Check every request against a schema first
- 23XSS Cross-site scripting
- 24CSRF Cross-site request forgery
- 25CORS Cross-origin resource sharing
- 26SSRF Server-side request forgery
- 27Hashing A one-way fingerprint
- 28Authentication Proving who you are
- 29Authorization What you're allowed to do
- 30Brute force Lock out repeated password guessing
Don't fall over
What keeps your app up when something it relies on is slow, broken, or hit twice at once.
- 31Timeouts Don't wait forever on a dead call
- 32Retry With backoff: wait longer each time
- 33Circuit breaker Stop calling a dead service
- 34Error handling Decide what happens when things break
- 35Race conditions Two requests, one resource
Fast at scale
Keeping things quick when a crowd shows up at once.
- 36Background jobs Do slow work off to the side
- 37Caching Do the work once, reuse it
- 38Rate limiting Cap requests per caller
- 39Pagination Hand back data in pages
See what's happening
When something breaks, find out what and why instead of guessing.
- 40Error tracking Every crash in one place
- 41Structured logs Logs you can actually search
Ship it & go live
Prove it works, get it online, give it a real address.
- 42Testing Catch the break before your users do
- 43CI/CD Push the code, the robot ships it
- 44Domain & DNS The name, pointed at your server
A few more blocks
Worth having as you go further.
- 45Unified interface One layer in front, automatic failover
- 46Playwright Test your app like a real user
- 47MCP Give your AI agent real tools
Written for people who build by prompting
You build with AI, but you ship blind.
Claude Code or Cursor writes the app. It works on your machine. You have no idea what it skipped. The blocks are that missing checklist.
You've been burned once already.
A leaked key. A lost table. A page that fell over the first time two people clicked at once. Every one of those has a block in here, and a prompt that would have caught it early.
You know the words exist. You just don't know which one to ask for.
Migrations, CSRF, N+1, circuit breaker. One page each: what it is, why it matters, and the exact sentence to hand your AI.
Hasan Aboul Hasan
I have been building software for 16 years. The last few years I build with AI, and teach it on YouTube and here. This book is the list I check before I trust anything an AI wrote for me. Now it's yours.
Questions
Is it really free?
Yes. The full 74-page book, not a sample chapter. Everything I can give away free, I do.
What happens after I put my email in?
You get a confirmation email. Click the button in it and the download starts. Over the next few days I send you a handful of the things that changed how I build. After that it's one email a week, every Saturday.
Do I need to know how to code?
No. It's written for people who build by prompting an AI. Every block is plain language, with a diagram, and it ends with a prompt you can paste as-is.
What format is it, and can I read it on my phone?
PDF, one block per page. It reads fine on a phone. It's built to be skimmed: find the block you need, read one page, hand the prompt to your AI.
Stop blind vibe coding.
47 blocks, 74 pages, one prompt per page. Confirm your email and the PDF is yours.