Here's a fun way (prompt) you can use the claude code security skill / slash command to run on your whole codebase instead of just PR's or uncommitted changes if you are wondering about how it stacks up to start: Run Anthropic's built-in /security-review on my ENTIRE codebase, not just a diff, then restore my git state exactly as it was. The built-in /security-review only scans `git diff origin/HEAD...` (branch vs remote default), so to scan everything you must present the whole tree to it as the diff: 1. Capture my current state first: current branch, whether origin/HEAD is set, and stash any uncommitted changes (git stash push -u) so nothing is lost. 2. Build an empty-base structure so the full tree shows as the diff: - empty=$(git commit-tree 4b825dc642cb6eb9a060e54bf8d69288fbee4904 -m "scan base") - w=$(git commit-tree $(git rev-parse HEAD^{tree}) -p $empty -m "scan tree") - git checkout -b secscan-tmp $w - git update-ref refs/remotes/origin/HEAD $empty - verify `git diff --name-only origin/HEAD...` lists all files 3. Invoke the actual built-in /security-review skill (its genuine identify → parallel false-positive filtering → confidence≥8 methodology). Do NOT substitute a manual review or a multi-agent workflow — I want the real feature. 4. ALWAYS restore afterward, even if the scan errors: checkout my original branch, delete secscan-tmp, restore origin/HEAD to its prior state (or delete the ref if it wasn't set), and pop my stash. Confirm `git status` matches the starting state. 5. Give me the final findings report, then a one-line confirmation that git is restored. Don't commit anything. Don't push.

📝 SUMMARY This week's call packed actionable intelligence on agentic development workflows, from dual-AI validation strategies to full-stack testing innovations. Patrick Chouinard shared his evolving "red team" approach using Claude Code alongside OpenAI Codex for adversarial validation, plus updates on a community RAG system and regulatory-driven SDLC requirements. Ty Wells demoed a user feedback hub and "Isotope" testing framework, while Morgan Cook showcased a digital signage engine and Elena presented a multi-cloud disaster recovery agent. The session wrapped with deep Q&A on Claude Code architecture, email automation safety guardrails, and targeting the right customer segment for AI consulting engagements. 💡 KEY INSIGHTS Red-team with different providers. Validate Claude Code output using OpenAI Codex (or vice versa) rather than the same model. Different biases mean flaws invisible to one may be caught by the other. Codex as adversarial harness. Prompt Codex to "destroy the application" when reviewing Claude Code output, then feed the failure reports back for remediation. Codex also includes GPT Image 2 in its $20/month subscription, useful for agentic image generation workflows without separate API costs. Security hygiene for AI skills. Avoid downloading skills from external repositories due to supply chain risks. Instead, use Claude Code's built-in skill creator to generate skills from completed work, or recreate them from reference. Agent design principles. Split agent responsibilities by context and single goals rather than human work logic. Giving one agent opposing objectives creates instability. It is acceptable for agents to have uneven workloads. Code generation vs artifact generation. When accuracy matters (like drawing precise graphics), ask AI to write code that generates the artifact rather than generating the artifact directly. AI evaluates code correctness better than visual correctness. Process before automation. AI amplifies broken processes. Clean up workflows before adding AI, then convert stable processes to deterministic scripts that run without AI for speed and reliability.

THIS IS A BRANDON WEEK!!! Yes this week Brandon will be leading the call, so make sure to post your question in the comments and join us for this monthly event! Last week we found out that Copilot Studio might be the "start here" tool — but definitely not the "stay here" tool. And if you want to know where enterprise AI is *actually* heading, the Anthropic + Microsoft partnership that came up on the call is worth paying close attention to. 📞 HOW THE CALLS WORK The calls can run 2+ hours. We want to make sure we're respecting everyone's time. Especially those of you who actually show up. Here's the structure: 👉 Reply to this post with your questions before the call 👉 If you submit a question and you're on the call, you go first 👉 We work through questions in the order they came in 👉 Then we open it up for everyone else If you can't make the call but want your question answered, drop it in the comments. We'll get to it. But priority goes to people who are there. The goal is simple: if you're taking the time to show up, you shouldn't have to wait behind questions from people who aren't even on the call. A few threads from last week are still very much alive. Patrick's community intelligence project is getting close to a demo — if you're curious what it actually looks like, this is the week to show up. David's event management platform demo was teased and we're still waiting on it. And Alex's government tender scraping agent raised a great question about using council meeting notes as early-signal data — that one deserves more airtime. 🔗 ZOOM LINK (save this) https://us06web.zoom.us/j/81995207847?pwd=Xe6u6LmIQOmCP5VTnOwWYjDBfZNKGB.1 📅 WHEN Tuesday April 21st at 6PM ET Looking forward to seeing you on the call!

Last week someone tried to demo a voice-integrated Claude Code setup live on the call... and the microphone had other plans. We never got the clean demo. This week, we're coming back for it. 📞 HOW THE CALLS WORK The calls can run 2+ hours. We want to make sure we're respecting everyone's time. Especially those of you who actually show up. Here's the structure: 👉 Reply to this post with your questions before the call 👉 If you submit a question and you're on the call, you go first 👉 We work through questions in the order they came in 👉 Then we open it up for everyone else If you can't make the call but want your question answered, drop it in the comments. We'll get to it. But priority goes to people who are there. The goal is simple: if you're taking the time to show up, you shouldn't have to wait behind questions from people who aren't even on the call. There's plenty of unfinished business from last week worth picking back up. Ty and Paul were both going to spin up Proxmox and Tailscale on their gaming PCs — curious how that went. Alex offered to share his full local AI stack as an MD file and we'd love to actually see it. And Ryan's hedge fund expense app is early-stage but has real legs — worth a check-in on where the architecture is heading. 🔗 ZOOM LINK (save this) https://us06web.zoom.us/j/81995207847?pwd=Xe6u6LmIQOmCP5VTnOwWYjDBfZNKGB.1 📅 WHEN Tuesday April 7th at 6PM ET Looking forward to seeing you on the call!

Hey everyone, Quick preview for Tuesday. Alongside whatever discussions and rabbit holes we get into on the call, I've got a short show & tell segment I'm looking forward to. Lately I've been using Claude's Cowork mode as my dev project manager, it tracks my projects, remembers context between sessions, knows my stack, my terms, my priorities. It's basically become the place where I think, plan, and build. In fact, the post you're reading right now was drafted there. One of the things that came out of that workflow is a Claude Code plugin ecosystem I've been putting together. That's what I'll be walking through: CC-StatusLine: a plugin that gives you a live dashboard in your Claude Code session. Context window usage with a color-coded progress bar, session cost, git info, model details, all at a glance. cmux-plugin: hooks Claude Code into the cmux terminal. Auto-named workspaces, completion notifications, live progress bars, browser splits. Knows when to stay silent if you're not running cmux. patchoutech-plugins, the branded marketplace that ties it all together. One command to add, one command to install. I'll show how the registry works and how you can spin up your own. If you've been curious about how Claude Code plugins work, hooks, skills, commands, the whole structure or you just want to see what it looks like when you let an AI help you manage the whole dev cycle from planning to shipping, this should be a fun one. See you Tuesday!