Tyler Garrett

Hi, I'm a successful vibe coder, and this is how I use my claude.md... These rules govern how we build and run. I'm releasing this because I want others a chance to lower the costs of their implementations and see what successful AI full-stack engineers/coder are using with their solution. This is a small claude.md file, it helps teach claude how to manage the repository while I work with it. I feel this particular setup is good for early projects, before they go online, or have any users.

Rule 1 — No ghosting: reusable tech lives in `/scripts/`

Every tool, shell command, query, or operational step that is reusable MUST be a committed file in /scripts/. Do not run know-how ad-hoc in a terminal and lose it. If you run something twice, or it encodes how the business works, script it and wire an npm run alias in package.json. One-off throwaway inspection is fine; anything that is "how we do X" is a script. This is how we avoid losing the tech.

Current scripts: init-db, import-targets, discover, geocode, passive-scan, chrome-recon, rollup, daily-charts, export-dashboard, agent, evolve, hunt, crawl, engage, demonstrate, blog, report, reset, repo-map, guard-confidential, deals, mailer, track, deploy.

Rule 2 — Internal-facing by default; nothing real goes public

Discovered targets, findings, posture scores, leads, and demonstration evidence are CONFIDENTIAL / internal-facing. We do not publish "here are local sites and their bugs." Concretely:

• The dashboard (apps/dashboard) and charts/ are INTERNAL — run locally or behind

auth, never deployed to the open web.

• The public marketing site (apps/marketing) uses only fictional/aggregate examples

for its generic, anonymous content. npm run guard fails the build if any real target host leaks into that generic content.

• The one deliberate exception is the self-serve portal (/portal, backed by

scripts/track.mjs's /api/): a business's own real name, domain, and findings are shown back to that business only, gated by the signed identity cookie minted when they scan their own* printed QR code (lib/session.mjs). This is not "publishing" — it's a client reading their own report. The hard invariant: every portal endpoint resolves the business strictly from the signed cookie, never from a client-supplied id/host/param, so scanning business A's QR can never surface business B's data. Anonymous visitors (no valid cookie, the overwhelming default) always see the generic content, never anyone's real data.

• Engagement evidence lives in engagements/ (gitignored) and is shared with the client

privately, never posted.

Rule 3 — Passive by default; active only under signed authorization; demos are safe

• Lead-gen recon is passive (browser/dig-equivalent). See [agents/_shared/ethics.md](./agents/_shared/ethics.md).
• The portal's "Recheck now" button (POST /api/rescan) runs the exact same passive checks

as npm run scan, on-demand, against the domain tied to the caller's own identity cookie — a site owner re-checking their own site is still passive recon, same as any browser visit. It stays inside Rule 3 because the target is never client-controlled (always the cookie-bound business's own domain) and rate-limited (RESCAN_COOLDOWN_MINUTES) so it can't be repurposed into a probe of anything else.

• When a lead asks us to prove a finding is real, we run the demonstration protocol

(npm run demonstrate <host>) — but only after npm run engage -- authorize … records a signed scope (note the --: it forwards flags through npm). Demonstrations are non-destructive (GET, TLS handshake, client-run PoC files); they never tamper, bypass auth, or exfiltrate real data.

• traits.risk_appetite stays 0 forever (evolution may not raise it). Authorization —

not a trait — is what unlocks the active lane. See [knowledge/90-demonstration-protocol.md](./knowledge/90-demonstration-protocol.md).

Rule 4 — Stack & cadence

React + Tailwind + Vite for apps; Astro for marketing. Analytics-first: charts over words, every day (npm run day → charts/index.html + dashboard). Every finding cites a security.md section.

Right now I my knee and going between the ice tub and the hot tub. I’m coming to the realization that a lot of people are very strong in this sport due to supplements, and if I’m going to be at that same tear or level,… I guess that means I also need to find out more my last few sparring sessions. I remember feeling my partner’s muscles, which sounds a little weird, but you have to understand these people are absolutely dominating me and I’m very interested. This is definitely the scariest injury I’ve ever had in my lifetime and I’m very fortunate that I’m able right now to walk on my knee and not in the hospital. What’s funny is you would think that something like this would make me not want to do Brazilian jujutsu but all I’m thinking about is how I can find one of the best people in the world to train with because I want to learn and I wanna keep going and I don’t mind the injuries as much as I thought I would. End of the day I’m hurting myself. My ego and my pride are still dying.

I don’t do a ton of pictures of the people I train with but this one I did. I think this was one of my favorite classes to. Was able to tape my fingers up, didn’t open the skin on that hand again. Def fucked my knee something pretty but met with exercise guru today who said I’m okay ✅ … but have to be careful next 24hrs

I’ve been very fortunate enough to be 100% referral based all year. Before this, we were 100% search engine optimization. No matter how good I think I am at seo, somebody’s better at cheating. No matter how good I think I am at hacking, somebody’s better at cheating. One reason I’m interested in BJJ is because you can’t cheat to be better, you actually have to work at it. today, I did a move that I’ve only seen people do in videos, I tried to do something I’ve never learned. Instantly I hear a noise in my knee. im in the ice tub, right now, im okay.. ai let’s me try something i saw a video of on YouTube, but doesn’t mean it will come out great if I’ve never done it before. It just means ai will do something, and someone might get hurt in the process.

Ah, the classic "Gi Burn" on the knuckles! That raw, missing skin on the Distal Interphalangeal (DIP) joint—right where the finger wrinkles below the nail—is another classic rite of passage for a BJJ white belt. [1, 2] When you are death-gripping a sleeve or collar, your partner will use explosive movements to tear your hands off. As the heavy, woven cotton of their Gi is ripped violently out of your hands, it acts like coarse sandpaper right across the tops of your bent finger joints, literally shaving the skin off. Because your skin is missing, keeping the area clean is vital to prevent staph, ringworm, or other common mat infections. [3, 4]

🩹 Off-the-Mat Healing Protocol

• Wash Immediately: The second class ends, scrub your hands thoroughly with defense soap or an antimicrobial soap using lukewarm water. Avoid scorching hot water, which dries out and splits the skin further. [4, 5, 6, 7]
• Keep It Moist: Do not let it dry out and crack. Apply a thick layer of Aquaphor Healing Ointment or Neosporin, then cover it with a standard adhesive bandage before bed to let the skin regenerate. [7, 8, 9]
• Moisturize Daily: Dry skin rips much easier than hydrated, elastic skin. Apply a heavy, non-water-based lotion or salve to your knuckles during the day when you aren't training. [1, 8]

🥋 How to Protect It While Rolling

Standard adhesive bandages will fly off within the first 30 seconds of warm-ups due to sweat and friction. Use this stacking method to keep training: [10]

1. The Shield Layer: Apply a thin layer of liquid bandage (like New Skin Liquid Bandage) directly onto the clean, dry raw spot. Let it dry completely. This creates a waterproof, sweat-resistant artificial scab that seals the nerve endings and keeps bacteria out. [1, 10]
2. The Anchor Tape: Take a thin strip of 0.3" or 0.5" rigid athletic tape. Wrap it securely 2 to 3 times around the phalanx below the raw wrinkle, and 2 to 3 times above it (right near the base of the nail). [2, 11, 12]
3. The "X" Guard: Cross the tape diagonally over the sides of the joint to connect the top and bottom loops. Crucially, leave the actual raw wrinkle exposed or lightly covered without tension so you can still fully bend your finger into a fist for boxing and BJJ. [2, 12, 13, 14]

To make sure I don't pick up a nasty infection, I'm using NEOSPORIN and taking a few days off. Attempting the keep it wet thing. lol

1] [https://www.reddit.com 2] [https://www.youtube.com 3] [https://www.instagram.com 4] [https://www.princetonbjj.com 5] [https://www.kingz.com 6] [https://www.firstderm.com 7] [https://skinintegra.com 8] [https://www.reddit.com 9] [https://www.reddit.com 10] [https://www.youtube.com 11] [https://grapplersperformx.com 12] [https://www.nagafighter.com 13] [https://www.youtube.com 14] [https://pillarsports.com

Excited to announce my domain name, 3 gyms into the journey, found a good local one near me called atos, and gracie barra have been the best, will keep track here: 1] [bjj.ac