Appendix F: Resources and Glossary
Official
- Claude Code documentation, the source of truth for commands, settings, and hooks
- Claude Code Code Review, managed PR review for Team and Enterprise
- Automated security reviews in Claude Code
- claude-code-security-review GitHub Action
- Claude Security, whole-codebase scanning for security teams
- anthropics/skills, official skills including skill-creator
Community
- awesome-claude-code, curated skills, hooks, agents, and plugins
- obra/superpowers, workflow plugin for planning, TDD, and debugging
- Trail of Bits skills, security-focused skills including CodeQL workflows
- How I Use Every Claude Code Feature by Shrivu Shankar, a candid practitioner review
- Claude Code customization guide by Alexander Opalic
Case studies and analysis cited in this book
- OpenObserve: autonomous QA with Claude Code subagents
- Writing tests with Claude Code by Bas Dijkstra
- Claude Code for QA testing by TestCollab
- Claude Code Security strengths and weaknesses by ReversingLabs
- 2025 GenAI Code Security Report by Veracode
- State of AI vs Human Code Generation by CodeRabbit
- GitGuardian on AI and secrets sprawl, 2026
- NVD: CVE-2025-48757 (Lovable)
- Anthropic: Claude Code Security announcement and coordinated vulnerability disclosure dashboard
- Why Claude Code Security is good news for the industry by Snyk
- Top Claude skills for cybersecurity by Snyk
From guptadeepak.com
- The Identity Crisis No One's Talking About: AI Agents and Vibe Coding
- MCP: A Comprehensive Guide to Extending AI Capabilities
- From Code to AI: 30 Years of Software Evolution
- The Complete Guide to Authentication Implementation
- Developer CIAM Landscape and Auth0 Alternatives
- Ebooks on AI agents, Zero Trust, identity, and GEO
- How to Build Authentication In-House: A Practitioner's Guide, for the auth-heavy services in Appendix A.10
- Cybersecurity articles
Glossary
| Term | Meaning |
|---|---|
| Agent | An AI system that plans and takes actions with tools, not just answers questions |
CLAUDE.md |
Memory file Claude Code reads at session start for project or personal instructions |
| Context window | Everything the model can see at once; quality drops as it fills |
| Compaction | Summarizing a conversation to free context while continuing the task |
| Headless mode | Running claude -p non-interactively for scripts and CI |
| Hook | Shell command run automatically at a lifecycle event |
| Marketplace | A catalog of plugins, often a Git repository |
| MCP | Model Context Protocol, the open standard connecting AI tools to external systems |
| Plan mode | Permission mode where Claude researches and proposes but does not edit |
| Plugin | Installable bundle of skills, subagents, hooks, commands, and MCP config |
| Prompt injection | Malicious instructions hidden in data the agent reads |
| Rewind | Returning a session to an earlier message and code state |
| Skill | Folder with a SKILL.md that Claude loads when a task matches its description |
| Slash command | A /name shortcut, built in or defined as a skill |
| Subagent | Separate Claude instance with its own context, prompt, and tool permissions |
| Worktree | Additional Git working directory on its own branch, used for parallel sessions |
A note on change
Claude Code ships updates weekly. Command names, flags, and features will drift from what is printed here. The principles will not: give the agent context, plan before building, verify with evidence, isolate what you can, and keep humans on the decisions that matter. When a detail here disagrees with the official documentation, trust the documentation, and send me a note so the next edition can catch up.
About the author
Deepak Gupta founded LoginRadius in 2013 and scaled it to serve more than 1 billion users, helping define what is now called customer identity and access management (CIAM). In 2024 he started GrackerAI, which does Generative Engine Optimization for B2B cybersecurity vendors, and he builds software with Claude Code every day.
He holds 5 granted patents spanning DDoS defense, IoT authentication, searchable encryption and AI fake-news detection, and has written 6 books. He runs two practitioner communities, Start with Identity and LogicBalls. More at guptadeepak.com/about.
Feedback
This book improves the same way a good CLAUDE.md does: through lessons learned in real use. If a pattern here failed for you, or you found a better one, I want to hear about it.