Claude Code Full Course 2026 | How Senior Engineers Actually Build with AI

Main ideas / lessons conveyed

• Claude Code is more than “prompted coding”: It becomes valuable when you give the agent tools + local project context + controlled permissions, so it can inspect, modify, run commands/tests, and iterate like an actual development workflow.
• Agentic workflow fundamentals: Most tasks follow a loop of (1) gather context → (2) take action → (3) verify results, repeating until tests/outputs are correct.
• Real engineering requires control and review: You should build in small chunks, review what the agent changed, and avoid letting the agent run wild—especially once the project grows or touches security-critical parts.
• Scale-up strategy is feature-based and safety-based:
  • Use Claude MD / agents MD for persistent project rules and conventions.
  • Use permissions to enforce what the agent may/can’t read/edit/execute.
  • Use plan mode when the agent needs to propose an approach before changing source code (e.g., database architecture/migrations).
  • Use skills to convert repeatable processes into reusable “mini-workflows”.
  • Use sub agents to isolate research across different parts of the codebase (context isolation / parallel investigation).
• Security and independent verification matter:
  • Don’t rely on Claude’s own judgement for security.
  • Use tools like Code Rabbit AI Deep Scan to find vulnerabilities across the whole repository and then confirm/fix findings with Claude.

Methodology / instruction-style workflow

A) Core Claude Code agent loop (how tasks typically run)

• Gather context
  • Read relevant files
  • Search codebase (glob/grep)
  • Inspect errors/test output
  • (If needed) web search/fetch for external docs or reference material
• Take action
  • Edit existing files
  • Write new files
  • Run terminal commands (bash) as required
• Verify
  • Run tests / builds / lint / type checks
  • Re-run failing tests after fixes
• Allow interruption
  • If Claude heads in the wrong direction, interrupt with Escape

B) Project setup and environment safety

• Create a local project folder (example used: an e-commerce “Atelier Store” app)
• Install Claude Code (terminal and/or VS Code extension)
• Trust the folder when prompted
• Run an initial scaffold task (example: create Next.js + TypeScript + Tailwind + Better-ORM + Drizzle + PostgreSQL via Neon)
• Protect sensitive files:
  • Use permissions to block credentials like .env, env.*, or secrets
  • Test the permission rule by asking Claude to read a blocked file and confirm access is refused

C) Session / command usage patterns (high level)

• Prefer iterative sessions when working on related tasks
• Use “one-off” execution for quick tasks (e.g., pipe logs into a one-off task)
• Choose model strength by task difficulty:
  • Fast model for routine edits/small fixes
  • Stronger reasoning model for architecture/refactors/integration-heavy debugging

D) Persistent instructions: Claude MD / agents MD

• Create a Claude/agents MD file that loads automatically at session start
• Put project facts and rules there, e.g.:
  • Preferred commands (package manager commands, build/test/typecheck commands)
  • Database conventions (Drizzle usage, schema location, “no raw SQL unless requested”)
  • Frontend design rules (use existing design system; avoid dashboard look; enforce editorial/product focus)
• Keep it small and specific:
  • Only include rules that prevent Claude from guessing wrong
  • Avoid dumping huge docs/API references
  • Follow guidance to keep instruction files under a reasonable size (commonly “well under 200 lines”)

Important nuance: Claude MD is guidance—it doesn’t hard-block behavior. Hard blocking is done with permissions/sandboxing.

E) Context management: context window, context rot, clear vs compact

• Watch context usage:
  • Use context inspection commands to see what’s consuming attention
• Prevent “context rot”:
  • Quality can degrade significantly well before the max token limit
• Reset when starting unrelated work:
  • Use clear for a fresh, empty context
• Use compact when you still want to keep the same overall thread but reduce clutter

F) Permissions model (allow / ask / deny)

• Define permission rules via project settings (example uses a .claude/settings.json style approach)
• Permission rule types:
  • deny: action is blocked by Claude Code itself (hard stop)
  • ask: Claude must request approval each time (or per matching action)
  • allow: Claude can do it without repeated approvals
• Rule priority:
  • If multiple rules match, evaluation order is deny → ask → allow
• Use-case examples from the lesson:
  • Allow safe dev commands (build/test/git status)
  • Ask before potentially dangerous actions (git push)
  • Deny reading .env files (so secrets can’t be accessed)

G) Plan mode (when approach must be reviewed before implementation)

Use plan mode when:

• The architecture/approach is expensive to undo
• Touching database structure, authentication, migrations, or large refactors
• Multiple parts of the system must change consistently

Plan workflow:

• Enable plan mode
• Ask Claude to:
  • Inspect current implementation
  • Propose database schema changes / migration approach
  • Identify which files will change
  • Show table relationships, stock representation, migrations strategy
• Review and possibly edit the proposed plan:
  • Spend time reading the plan (e.g., 5–10 minutes)
  • Change wrong assumptions before approving
• Approve the plan:
  • Approving exits plan mode and triggers execution

H) Skills (turn repeatable procedures into reusable workflows)

• What a skill is:
  • A folder containing a skill.md
  • Includes metadata (name/description) and an invocation condition
  • Includes step-by-step behavior and optional arguments
• Where skills live:
  • Project-scoped skills inside the project (commit with code)
  • Global skills for all projects (under local Claude folder)
• How to decide what goes into Claude MD vs a skill:
  • Claude MD: project facts (“use Drizzle”, “run pm2pm dev”)
  • Skill: repeatable process (“build/verify responsive UI pages”, “inspect and implement UI using existing design system”, etc.)
• Invocation:
  • Claude can load skills when the request matches their description (model-invoked skills)
  • You can also call skills explicitly by command

Example skill behavior (“build UI” skill):

• Inspect current UI/components
• Reuse design system
• Implement feature page/section
• Keep it responsive and consistent
• Verify output

I) Sub agents (context isolation + parallel investigation)

When to use sub agents:

• Codebase is large enough that research shouldn’t all live in the main context
• Multiple independent investigations are needed before building a feature

Sub-agent workflow:

• In the main session, delegate tasks:
  • “Investigate data model”
  • “Investigate stock/inventory behavior”
  • “Investigate admin authentication”
  • “Investigate order lifecycle”
  • “Investigate existing UI patterns”
• Run them in parallel (“fan out”)
• Main agent waits for summaries
• Main agent compiles findings into a concise plan
• Then proceed with plan mode + implementation

Key principle: Sub agents are not “better minds” automatically; they exist to split investigation and preserve main-context clarity.

J) Security workflow: independent scanning + fix decisions

• After major backend changes (like real database/auth), do a full repo security scan
• Use Code Rabbit AI Deep Scan to:
  • Detect vulnerabilities across the repository (not just one diff)
  • Categorize findings by severity
  • Provide evidence and explanation of impact
• Triage each finding:
  • Confirm if the issue is real
  • Decide whether to fix immediately or document for later
  • Use Claude Code to investigate and patch, but don’t treat Claude as the only security reviewer
• Typical fixes shown:
  • Enforce strong secret requirements / reject weak/default secrets
  • Fix HTML form behavior that leaks user-entered data (e.g., missing form method → GET request)
  • Consider whether information disclosure is critical immediately vs requires a larger process (e.g., email verification)

Speakers / sources featured (identified from subtitles)

• Main narrator / course creator: Speaker of the subtitles (not explicitly named in the provided text)
• Anthropic (referenced as the company behind Claude / Claude Code)
• Code Rabbit (sponsored segment; includes “AI Deep Scan” feature)
• GitHub (used as a repository destination)
• Neon (used as the PostgreSQL provider)
• Better-ORM / Betteroth (mentioned as part of the stack and provides a skills pack)
• Stripe (used via an official Claude plugin for checkout)
• OpenAI (mentioned in the security discussion about sandbox escape incidents)
• Hugging Face (mentioned as an external infrastructure affected in the OpenAI incident)