Coding with AI with Claude

After the course, participants will be able to:

• Use Claude Code as a pair programmer for feature work, refactoring, and debugging
• Write effective prompts that turn vague requirements into production-quality code
• Navigate and safely refactor large, unfamiliar codebases with AI assistance
• Generate meaningful tests and debug from logs and stack traces
• Use AI in the delivery workflow: PR reviews, commit messages, CI/CD, and IaC
• Judge where AI output must be distrusted, reviewed, or constrained
• Choose the right AI coding tool for a given task
• Recognize and contain the security failure modes specific to AI features (prompt injection, untrusted output, denial-of-wallet)
• Apply developer-owned controls — secret management, least privilege, guardrails, cost limits — before deploying
• Red-team their own AI features and score them with the Elephant Scale Secure AI Score (SAIS-100)

• Software Engineers and Architects
• Data Scientists
• DevOps Engineers
• Technical Leads

• Strong programming experience (Python, Java, JavaScript, or similar)
• Git/GitHub or GitLab basics
• Familiarity with APIs and basic system design

Day 1 — AI as a Pair Programmer Module 1: The AI Coding Landscape & Claude Code Foundations

• What AI coding agents do well vs. common failure modes
• The tool landscape: Claude Code, Cursor, Windsurf, GitHub Copilot, Codex, Replit
• Where Claude Code fits and why (agentic, codebase-aware, terminal-native)
• Context windows and long-form reasoning
• Security, IP, and enterprise usage considerations

Lab - Implement a feature without AI, then re-implement with Claude Code - Compare speed, quality, and maintainability Module 2: Prompting for Real Code

• Prompt patterns for feature development, bug fixing, refactoring, test generation
• Asking for design rationale and tradeoffs
• Iterative prompting strategies

Lab - Convert vague requirements into production-quality code - Improve results through iterative prompting Module 3: Understanding & Refactoring Existing Code

• Working with large codebases and dependency mapping
• Architectural explanation and identifying technical debt
• Safe, incremental refactoring strategies

Lab - Analyze a real repository: have Claude Code explain the architecture, flag risks, and propose a refactoring plan; implement a selected refactor Module 4: Testing & Debugging with AI

• Generating unit and integration tests; identifying edge cases
• Debugging from logs and stack traces
• Creating regression tests from real bugs

Lab - Generate a test suite; debug a failing service using logs only ________________________________________ Day 2 — AI for Architecture and Delivery Module 5: System Design with AI

• Translating business requirements into system architecture
• API and data model design; performance and scalability considerations
• Using AI to critique and challenge your designs

Lab - Design a small system (e.g., a document-processing service); iterate on feedback Module 6: AI in the Development Workflow

• PR reviews, commit-message generation, and code-quality analysis
• AI-assisted code review — and when/why to distrust AI output

Lab - Run a simulated PR review; fix the issues the AI identifies Module 7: AI-Assisted DevOps and Automation

• Writing CI/CD pipelines; Dockerfile generation and optimization
• Shell/scripting assistance; infrastructure-as-code

Lab - Generate a CI pipeline; optimize build and deployment steps (The capstone moves to the end of Day 3 so it includes security hardening — see Module 12.) ________________________________________ Day 3 — Security of AI Deployments You just learned to build fast with AI. This day is about shipping what you built without getting burned: the security failure modes specific to AI features and the controls a developer owns in code. Drawn from Elephant Scale’s dedicated AI-security courses, focused here on deploy-time concerns for teams building with AI coding tools. Module 8: The AI Attack Surface for Builders

• Why AI features fail differently — semantic attacks, not just syntactic
• Prompt injection (direct and indirect) against apps you build
• Treating model output as untrusted input to the rest of your system
• Insecure output handling: XSS, SSRF, command/SQL injection downstream
• The trust boundaries a developer actually owns

Lab - Attack an AI feature you built with Claude Code; contain the blast radius and add output validation/encoding Module 9: Secrets, Identity, and Cost Controls

• API-key and secret management (never in prompts, code, or logs)
• Per-user authn/authz for AI features; propagating identity to tools and retrieval
• Denial-of-wallet: rate limits, token budgets, and timeouts
• Logging without leaking secrets or PII

Lab - Get secrets out of the prompt/code path; add per-user rate limits and a cost budget Module 10: Guardrails, Agents, and Secure Deployment

• Input/output guardrail layers: what they catch and what they miss
• Least privilege, allowlists, and approval gates for agents and tools
• Sandboxing tool execution; scoped, short-lived credentials
• Secure deployment: configuration, dependencies, and supply chain (pinning, provenance)
• RAG security at ingestion and retrieval (where applicable)

Lab - Lock down an over-permissioned agent; add an input/output guardrail layer Module 11: Red-Teaming and Scoring Your AI App

• Building an automated abuse/red-team suite for AI features
• Prompt-injection and jailbreak regression tests in CI
• Scoring an app’s security with the Elephant Scale Secure AI Score (SAIS-100)
• A pre-ship security checklist for AI features

Lab - Write automated red-team tests and wire them into CI; score the app on the SAIS-100 Capstone: Build, Secure, and Ship End-to-end project that carries the feature you built on Days 1–2 through to a deployment-ready state: requirements ? design ? implementation ? tests ? security hardening ? red-team pass ? PR, with Claude Code used throughout under defined guardrails. Emphasis on code quality, explainability, maintainability — and now shippable security. ________________________________________ Optional Enterprise / Government Add-Ons

• Secure AI usage policies and content-exclusion settings for proprietary code
• Working with regulated/proprietary codebases
• Auditability and traceability of AI-assisted changes

Outcomes Participants leave with a repeatable AI-assisted development workflow, proven prompt templates for daily engineering tasks, a clear sense of the tools’ strengths and limits, and a complete repository demonstrating responsible AI-assisted coding.