One rule
Make the assistant read the code before it explains the code. If it has not inspected the relevant files, treat the answer as a guess.
Why this matters
In internships and hackathons, you often join an existing repo. You need to understand it fast without pretending you wrote every line yourself.
AI can help you build a map. But it can also fill gaps with confident nonsense. Your job is to ask narrow questions, check the files, and keep notes you can explain later.
Ask better questions
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done
Good prompt
Use this when you inherit a project from a teammate or an AI scaffold. It keeps the assistant grounded in the repo.
Read the relevant files before answering.
Do not speculate about files you have not opened.
Goal: I need to understand how login works so I can review it safely.
Please explain:
1. Which files handle login routes, form submission, and session/token storage.
2. The data flow from user input to server response.
3. Any security risks you can confirm from the code.
4. What I should test manually.
If something is not present in the repo, write "not found".Make a codebase map
Create a short note while you learn. This is not extra work. It becomes proof that you reviewed the project instead of blindly accepting generated code.
Keep it simple: main folders, key flows, risky files, and tests you ran. Add it to your README later as your review summary.
Common mistake
Do not ask “explain this repo” and paste the answer into your README. That usually gives a broad summary, misses edge cases, and may mention files or APIs that are not real.
Also avoid pasting secret files into external chats. Use repo instructions and scoped context where your tool supports it. Sensitive files should stay out of AI context.
Learning note
Keep a file like this locally or add a cleaned version to your README. It shows what you checked.
AI-assisted codebase notes
Feature reviewed: Login
Files checked:
- src/routes/auth.js
- src/controllers/authController.js
- src/middleware/session.js
What I understood:
- Login form sends email and password to POST /login.
- authController checks the user record and creates a session.
- session middleware protects private routes.
Verification done:
- Tried wrong password and got an error.
- Tried valid login and reached dashboard.
- Checked that no API keys or passwords are hardcoded in these files.
Open questions:
- Need to confirm session expiry behavior.Do this now
Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.
0 of 5 done