Hardcoding — What Claude Gets Wrong

You write code that works on your machine. Every URL is localhost, every timeout is a bare 30, every credential is inline. The code compiles, the tests pass, and it's undeployable.

The Iron Rule

No literal URLs, ports, durations, sizes, or credentials in business logic. Ever.

All tunable values must come from a config struct/object that is:

1. Passed as a parameter (not read from env inside business logic)
2. Validated at startup (not on first use)
3. Documented with sensible defaults where appropriate

Anti-Patterns You Default To