Not sure how you feel about it but Gemini CLI feels like garbage at the moment compared to Claude Code. It's slow, it doesn't listen to instructions or use tools as well as Claude.

But it has that huge context window we all love.

So I just added instructions to CLAUDE.md to have Claude use the Gemini CLI in non-interactive mode (passing the -p param with a prompt to just get a response back from the CLI) when it needs to gather information about a large part of the codebase.

That way you get the best of both worlds, Claude doesn't waste context and Gemini doesn't waste your time.

Add this (or a modified version) to your CLAUDE.md and tell Claude to use gemini manually or it will do it on it's own as needed.

 # Using Gemini CLI for Large Codebase Analysis

  When analyzing large codebases or multiple files that might exceed context limits, use the Gemini CLI with its massive
  context window. Use `gemini -p` to leverage Google Gemini's large context capacity.

  ## File and Directory Inclusion Syntax

  Use the `@` syntax to include files and directories in your Gemini prompts. The paths should be relative to WHERE you run the
   gemini command:

  ### Examples:

  **Single file analysis:**
  ```bash
  gemini -p "@src/main.py Explain this file's purpose and structure"

  Multiple files:
  gemini -p "@package.json @src/index.js Analyze the dependencies used in the code"

  Entire directory:
  gemini -p "@src/ Summarize the architecture of this codebase"

  Multiple directories:
  gemini -p "@src/ @tests/ Analyze test coverage for the source code"

  Current directory and subdirectories:
  gemini -p "@./ Give me an overview of this entire project"
  
#
 Or use --all_files flag:
  gemini --all_files -p "Analyze the project structure and dependencies"

  Implementation Verification Examples

  Check if a feature is implemented:
  gemini -p "@src/ @lib/ Has dark mode been implemented in this codebase? Show me the relevant files and functions"

  Verify authentication implementation:
  gemini -p "@src/ @middleware/ Is JWT authentication implemented? List all auth-related endpoints and middleware"

  Check for specific patterns:
  gemini -p "@src/ Are there any React hooks that handle WebSocket connections? List them with file paths"

  Verify error handling:
  gemini -p "@src/ @api/ Is proper error handling implemented for all API endpoints? Show examples of try-catch blocks"

  Check for rate limiting:
  gemini -p "@backend/ @middleware/ Is rate limiting implemented for the API? Show the implementation details"

  Verify caching strategy:
  gemini -p "@src/ @lib/ @services/ Is Redis caching implemented? List all cache-related functions and their usage"

  Check for specific security measures:
  gemini -p "@src/ @api/ Are SQL injection protections implemented? Show how user inputs are sanitized"

  Verify test coverage for features:
  gemini -p "@src/payment/ @tests/ Is the payment processing module fully tested? List all test cases"

  When to Use Gemini CLI

  Use gemini -p when:
  - Analyzing entire codebases or large directories
  - Comparing multiple large files
  - Need to understand project-wide patterns or architecture
  - Current context window is insufficient for the task
  - Working with files totaling more than 100KB
  - Verifying if specific features, patterns, or security measures are implemented
  - Checking for the presence of certain coding patterns across the entire codebase

  Important Notes

  - Paths in @ syntax are relative to your current working directory when invoking gemini
  - The CLI will include file contents directly in the context
  - No need for --yolo flag for read-only analysis
  - Gemini's context window can handle entire codebases that would overflow Claude's context
  - When checking implementations, be specific about what you're looking for to get accurate results # Using Gemini CLI for Large Codebase Analysis


  When analyzing large codebases or multiple files that might exceed context limits, use the Gemini CLI with its massive
  context window. Use `gemini -p` to leverage Google Gemini's large context capacity.


  ## File and Directory Inclusion Syntax


  Use the `@` syntax to include files and directories in your Gemini prompts. The paths should be relative to WHERE you run the
   gemini command:


  ### Examples:


  **Single file analysis:**
  ```bash
  gemini -p "@src/main.py Explain this file's purpose and structure"


  Multiple files:
  gemini -p "@package.json @src/index.js Analyze the dependencies used in the code"


  Entire directory:
  gemini -p "@src/ Summarize the architecture of this codebase"


  Multiple directories:
  gemini -p "@src/ @tests/ Analyze test coverage for the source code"


  Current directory and subdirectories:
  gemini -p "@./ Give me an overview of this entire project"
  # Or use --all_files flag:
  gemini --all_files -p "Analyze the project structure and dependencies"


  Implementation Verification Examples


  Check if a feature is implemented:
  gemini -p "@src/ @lib/ Has dark mode been implemented in this codebase? Show me the relevant files and functions"


  Verify authentication implementation:
  gemini -p "@src/ @middleware/ Is JWT authentication implemented? List all auth-related endpoints and middleware"


  Check for specific patterns:
  gemini -p "@src/ Are there any React hooks that handle WebSocket connections? List them with file paths"


  Verify error handling:
  gemini -p "@src/ @api/ Is proper error handling implemented for all API endpoints? Show examples of try-catch blocks"


  Check for rate limiting:
  gemini -p "@backend/ @middleware/ Is rate limiting implemented for the API? Show the implementation details"


  Verify caching strategy:
  gemini -p "@src/ @lib/ @services/ Is Redis caching implemented? List all cache-related functions and their usage"


  Check for specific security measures:
  gemini -p "@src/ @api/ Are SQL injection protections implemented? Show how user inputs are sanitized"


  Verify test coverage for features:
  gemini -p "@src/payment/ @tests/ Is the payment processing module fully tested? List all test cases"


  When to Use Gemini CLI


  Use gemini -p when:
  - Analyzing entire codebases or large directories
  - Comparing multiple large files
  - Need to understand project-wide patterns or architecture
  - Current context window is insufficient for the task
  - Working with files totaling more than 100KB
  - Verifying if specific features, patterns, or security measures are implemented
  - Checking for the presence of certain coding patterns across the entire codebase


  Important Notes


  - Paths in @ syntax are relative to your current working directory when invoking gemini
  - The CLI will include file contents directly in the context
  - No need for --yolo flag for read-only analysis
  - Gemini's context window can handle entire codebases that would overflow Claude's context
  - When checking implementations, be specific about what you're looking for to get accurate results

It has far surpassed my expectations. FUck it i dont care if china is harvesting my data or whatever this model is so good. I sound like a fucking spy rn lmfao but goodness gracious its just able to solve whatever chatgpt isnt able to. Not to mention its really fast as well

The difference is GPT-5 thinks A LOT to get that benchmarks while Opus doesn't think at all.

I am totally in love with this thing.

I used it to generate 200 lines of functionality code for a game state validation tool in addition to another 200 lines of corresponding unit tests (C#). The functionality is based on an existing class which is 700 lines long before adding the changes.

I was mind blown because I could copy paste the code and it works from the first run without any compile errors. Not to mention that it's incredibly fast. TWO HUNDRED LINES. HOLY SHIT. I just did two days work in two damn hours!

This feels like programming on steroids and it's totally in a different league.

I'm using it through the API with my own API key (model name: gpt-4o-2024-05-13) with Cursor. I'm curious to hear the experiences of my fellow programmers.

Register now: localhost:3000/registration

I'm a pentester (ethical hacker) who codes SaaS part-time. I've reviewed hundreds of apps over the years, and honestly? Most have the same holes. Here's what actually keeps you safe.

• AI code review catches most issues (fr)

Look, I get it. You're shipping fast. But let Coderabbit review every pull request. It'll catch SQL injection, exposed credentials, broken auth before anything goes live.

Here's a wild one: during a recent pentest, I found a race condition in a client's payment system that was double-charging customers. The dev wrote it late night with AI help. Looked totally fine to them. Would've been an absolute nightmare in production.

• Rate limiting stops the spam (and saves your wallet)

I've seen apps get absolutely hammered with 10,000+ fake registrations in minutes. Rate limiting shuts that down real quick.

Without it, you're basically paying for spam. Your database fills with garbage, your email service burns through the monthly quota, and boom: One client ended up with a $500+ AWS bill from a single bot attack. Not fun lol

Start strict: 100 requests/hour per IP. You can always loosen it later if real users complain, but honestly? They won't.

• Enable RLS from day 0

Row Level Security means users can only see their own data. Postgres enforces it at the database level, which is exactly where you want it.

Found a dashboard during a pentest once with no RLS. I changed one URL parameter and suddenly I'm looking at everyone's data. That's literally how most data leaks happen - someone forgets this one thing.

Let AI write your RLS policies if you want, but double-check them and actually try to break them yourself.

• Hide your API keys (seriously)

API keys in code will get stolen. Not maybe. Will.

During pentests, I find exposed AWS keys, Stripe tokens, database passwords in repos all the time. GitHub bots are scraping for these 24/7: they'll find yours in minutes.

Google Secret Manager or AWS Secrets Manager. That's it. Keys live there, not in your repo. And rotate them every 90 days. Takes like 10 minutes.

• CAPTCHA stops bots

I've tested tons of apps with and without CAPTCHA. The difference is honestly massive - we're talking 99% spam reduction.

Without it? You're looking at 200+ garbage submissions daily. "Buy our SEO services" and crypto scams filling up your database. It's annoying as hell.

Use invisible mode so real people never even see it. Bots get challenged. Slap it everywhere: contact forms, registration, login, password reset.

• HTTPS isn't optional

Every endpoint needs HTTPS. Redirect HTTP automatically. Zero exceptions here.

I intercept unencrypted traffic during pentests constantly, and you'd be shocked what I see. Session tokens, passwords, API keys - all just sitting there in plain text. It's 2025, people.

Let's Encrypt gives you free certificates. There's literally no excuse.

• Sanitize every input

Validate on the frontend. Validate again on the backend. Trust nothing users send you - and I mean nothing.

During pentests, I'm injecting malicious code through forms, URL parameters, file uploads. Most apps fail this test. Don't be most apps.

• Update your dependencies

Old packages have known vulnerabilities. When I'm testing security, those are the first things I go after.

Turn on Dependabot or Renovate. Update monthly at minimum. Security patches? Apply them the same day. This one's non-negotiable.

AI makes you fast. But speed without security is just... well, it's just speed toward disaster.

Here's what works: one AI writes your code. Another AI (Coderabbit) audits it. You review the audit. Three layers catching issues before they become problems.

Also, rate limiting protects you when things go right too. Your app goes viral? Traffic spikes 1000x overnight? Limits keep your servers up and your costs reasonable.

From pentesting hundreds of apps: these controls stop 95% of attacks. The other 5% requires skills most hackers don't have, so you're good.

Seriously: I've seen apps lose 40% of users after breaches. $50,000+ incident response bills. Reputations take years to recover.

These controls work. Clients stay. They send referrals.

I've always wanted to learn how to code... but endless tutorials and dry documentation made it feel impossible.

I'm a motion designer, I learn by clicking buttons until something works–but with coding? There are NO BUTTONS. Just a blank file and a blinking cursor starting back at me.

I had some light React experience, and I was surprisingly good at CSS (probably thanks to my design background). But so far, I had yet to build anything real.

Then, I had an idea I HAD to create – The Focus Project.

So, I turned to AI.

It was the button I had been looking for. I could click it and get working code... (kinda.)

Here are the lessons I learned building my first app:

1. The more "popular" your problem is, the easier AI can solve it.
If your problem is common, AI will nail it. If it's niche, AI becomes an improv comedian, confidently making things up.

Great at: Perfect syntax for map method or useEffect hook.
Terrible at: Debugging electron-builder failures. AI just hallucinates custom configs that don't exist.

2. AI struggles with big-picture thinking
AI works best for small, isolated problems but collapses when a change affects multiple files across the app.

Example: I asked AI to add a database to my app, instead of running everything on local state. AI BROKE EVERYTHING trying to refactor. Too many files, too much context - it just couldn't handle it.

3. If you don't understand how your app works, AI won't either.
Early on, I had no clue how Electron's renderer and main processes talked to each other. So, AI gave me broken, half-baked IPC communication attempts.

Once I actually understood IPC channels, my prompts improved, and AI's responses instantly improved.

4. Problem Solving Loops
I'm embarrassed to admit how many hours I wasted doing this:

💬 Me: "AI, build this feature!"
🤖 AI: [Generates buggy code]
💬 Me: "AI, this code is buggy."
🤖 AI: [Generates different buggy code]
💬 Me: "Here's more context!"
🤖 AI: [Reverts back to original buggy code]
💬 Me: "... AI... nevermind, I'll just read the documentation."

5. At some point, AI will make you roll your eyes.
The first time AI gave me a terrible suggestion, something clicked. Not only was it wrong - I knew it was wrong, and I knew a better way.

That's when I realized I was actually learning to code.

Final Thoughts
I started this journey terrified of documentation and horrified by stack traces...

Now? I actually read errors. And sometimes, I even read documentation BEFORE prompting AI.

AI is great at explaining complex problems, but it ins't wise. It does what you ask, but it doesn't ask the right questions. Want proof?

Three quick conversations with my actual developer friend changed my approach and my app far more than AI ever could.

Without AI, The Focus Project Wouldn't Exist - but AI also forced me to actually learn to code.

AI got me further than I ever could’ve on my own… but not without some serious headaches. Have you had any AI coding wins (or disasters)?

Update for the curious:
In case you're interested in how The Focus Project (the desktop application I built) turned out or the tools I used to build it, here's a little video:

The tools I messed around with: Cursor, Copilot, Windsurf, Sonnet 3.5, gpt-4o, o1, gemini-2.0-flash
My favorites were: Cursor and Sonnet 3.5

Tech Stack: Electron-vite, TypeScript, Tailwind, Better SQLite3, and Kysely.

Honestly, if it weren’t for ChatGPT, I might have lost my job due to my performance. Sometimes, the tasks I’m assigned leave me completely clueless about where to begin or how to approach a solution. I’m incredibly grateful that AI emerged during my career, and I’m even more thankful that it’s here to stay.

Thank you, ChatGPT!

EDIT - you salty asss hoes in the comment, chill...it goes through code review, if someone don't like it or have something to say they comment of code review, its not that I can just blindly merge the changes, hoes will be hoes, for the streets salty devs

I've been using both Cline and Cursor extensively over the past 3 months and wanted to share my experience, especially since I see a lot of Cursor recommendations here. For context: full-stack dev, primarily working on Node.js/React/Nextjs projects.

TLDR: Both are solid tools but Cline is in a different league, though it comes with higher (but worth it) costs. I personally like to use Cline inside of Cursor to get the best of both worlds.

Here's the thing about AI coding assistants that took me a while to understand: You get what you pay for. Literally.

The Cost Reality:

• Cursor charges $20/month flat rate

• Cline uses your own API keys & tokens (I personally use OpenRouter, but you can use any provider that works for you)

• I've spent $20+ in a single evening with Cline (yes, an entire month's worth of Cursor)

• And you know what? Totally worth it.

Why Cline is Better:

• Works in your existing IDE (huge win - I can use Cline in VS Code and/or in Cursor)

• Uses higher quality models because you're paying for actual token usage

• Reads EVERY relevant file into context (not just a limited subset)

• Actually understands your entire codebase

• The interactions feel human - it asks clarifying questions and makes sure it understands your goals

The "Holy Shit" Moment: I was skeptical about the cost at first. Then I asked Cline to handle a complex refactoring task in an existing codebase. It just... did it? Not only that, it asked smart questions along the way to ensure it was aligned with my intentions. That's when it clicked - this is how AI pair programming should feel.

Where Cursor Excels:

• Simpler, predictable pricing

• Good for basic code completion

• Works well enough for quick edits (which Cline doesn't offer due to its focus on the autonomous coding use-case)

• Built-in codebase indexing

The Real Talk about Cost: Yes, there were nights where I spent $50+ in a single hour using Cline. But here's the perspective shift that helped me: If it saves me 3-4 hours of work, that's an incredible ROI. Stop thinking about it as a monthly subscription and start thinking about it as paying for a 10x force multiplier.

Here's what happens in practice: With Cursor, you're often fighting against context limitations and getting incomplete solutions because they have to optimize for token usage to maintain their pricing model.

With Cline, it's like having a senior dev who actually reads and understands your entire codebase before making suggestions. It's comprehensive, thoughtful, and actually saves you time in the long run.

Bottom line: If you want basic code completion with predictable pricing, Cursor works. But if you want something that truly feels like the future of AI-powered development and don't mind paying for quality, Cline is on another level. Another tip: I use cline *within* Cursor. That way, I get the simple code completion from Cursor, while also using Cline for big changes that save me a lot of time.

Ever since ChatGPT-3.5 was released, my life was changed forever. I quickly began using it for personal projects, and as soon as GPT-4 was released, I signed up without a second of hesitation. Shortly thereafter, as an automation engineer moving from Go to Python, and from classic front end and REST API testing to a heavy networking product, I found myself completely lost. BUT - ChatGPT to the rescue, and I found myself navigating the complex new reality with relative ease.

I simply am constantly copy-pasting entire snippets, entire functions, entire function trees, climbing up the function hierarchy and having GPT just explain both the python code and syntax and networking in general. It excels as a teacher, as I simply query it to explain each and every concept, climbing up the conceptual ladder any time I don't understand something.

Then when I need to write new code, I simply feed similar functions to GPT, tell it what I need, instruct it to write it using best-practice and following the conventions of my code base. It's incredible how quickly it spits it out.

It doesn't always work at first, but then I simply have it add debug logging and use it to brainstorm for possible issues.

I've done this to quickly implement tasks that would have taken me days to accomplish. Most importantly, it gives me the confidence that I can basically do anything, as GPT, with proper guidance, is a star developer.

My manager is really happy with me so far, at least from the feedback I've received in my latest 1:1.

The only thing that I struggle with is ethical - how much should I blur the information I copy-paste? I'm not actually putting any really sensitive there, so I don't think it's an issue. Obviously no api keys or passwords or anything, and it's testing code so certainly no core IP being shared.

I've written elsewhere (see my bio) about how I've used this in my personal life, allowing me to build a full stack application, but it's actually my professional life that has changed more.

I wrote an SOP recently for creating software with the help of LLMs like ChatGPT or Claude. A lot of people found it helpful so I wanted to share some more prompt-related ideas for generating code.

The prompts offered below work much better if you set up a proper foundation for your program before-hand (i.e. provide the AI with more context, as detailed in the SOP), so please be sure to take a look at that first if you haven't already.

My Standard Prompt for Code Generation

Here's my go-to template for requesting code:

I need to implement [specific functionality] in [programming language].
Key requirements:
1. [Requirement 1]
2. [Requirement 2]
3. [Requirement 3]
Please consider:
- Error handling
- Edge cases
- Performance optimization
- Best practices for [language/framework]
Please do not unnecessarily remove any comments or code.
Generate the code with clear comments explaining the logic.

This structured approach helps the AI understand exactly what you need and consider important aspects that you might forget to mention explicitly.

Reviewing and Understanding AI-Generated Code

Never, ever blindly copy-paste AI-generated code into your project. Ask for an explanation first. Trust me. This will save you considerable debugging time and you will also learn a thing or two in the process.

Here's a prompt I use for getting explanations:

Can you explain the following part of the code in detail:
[paste code section]
Specifically:
1. What is the purpose of this section?
2. How does it work step-by-step?
3. Are there any potential issues or limitations with this approach?

Using AI for Code Reviews and Improvements

AI is great for catching issues you might miss and suggesting improvements.

Try this prompt for code review:

Please review the following code:
[paste your code]
Consider:
1. Code quality and adherence to best practices
2. Potential bugs or edge cases
3. Performance optimizations
4. Readability and maintainability
5. Any security concerns
Suggest improvements and explain your reasoning for each suggestion.

Prompt Ideas for Various Coding Tasks

For implementing a specific algorithm:

Implement a [name of algorithm] in [programming language]. Please include:
1. The main function with clear parameter and return types
2. Helper functions if necessary
3. Time and space complexity analysis
4. Example usage

For creating a class or module:

Create a [class/module] for [specific functionality] in [programming language].
Include:
1. Constructor/initialization
2. Main methods with clear docstrings
3. Any necessary private helper methods
4. Proper encapsulation and adherence to OOP principles

For optimizing existing code:

Here's a piece of code that needs optimization:
[paste code]
Please suggest optimizations to improve its performance. For each suggestion, explain the expected improvement and any trade-offs.

For writing unit tests:

Generate unit tests for the following function:
[paste function]
Include tests for:
1. Normal expected inputs
2. Edge cases
3. Invalid inputs
Use [preferred testing framework] syntax.

I've written a much more detailed guide on creating software with AI-assistance here which you might find more helpful.

As always, I hope this lets you make the most out of your LLM of choice. If you have any suggestions on improving some of these prompts, do let me know!

Happy coding!