Set up Claude Code for a real SaaS codebase: browser access, allow and deny lists, tests after features and a user-focused system prompt

Out of the box, a coding agent stops to ask for help, can run destructive database commands and produces features that do not fit the users. A solo founder ends up cleaning up more than building.

1. Start Claude Code with its Chrome connection so it can open the running app, click through pages, take screenshots and inspect the page to find layout and consistency problems. 2. Put safe commands in the allow list of the local settings file and put destructive database commands (in his Laravel app, wipe, fresh migration and other database commands) in the deny list. Keep bash execution tightly restricted, because the agent can otherwise write a script that runs a denied command. 3. For longer tasks, use a stop-hook loop plugin (the Ralph Wiggum plugin) that feeds the same prompt back until a stated completion goal is met. 4. Build the feature first, then have the agent write tests and make all of them pass before committing. He found that writing tests first made the agent loop on failing tests while it was still experimenting. 5. Run tests against a dedicated test environment and database, separate from development, staging and production. 6. Write a system prompt that describes the project, what it can do and above all the ideal user, so new features match what users need. He also uses a public system prompt (the Augster prompt) that defines what good code looks like.

The author says he has used this setup for over six months to build his platform and that without it users spend more time fixing messes than shipping. He gives no measured results: no time saved, defect rates or costs beyond recommending the Max plan over the $20 plan for continuous use. His claim that this puts someone in the top one or two percent of users is his own estimate.

Advice and configuration from one experienced founder, not a measured comparison. The source says his advice changes almost weekly, so details may already be out of date. The deny list can be bypassed through scripts unless bash is restricted. The stop-hook loop is a third-party plugin, not a built-in feature. The examples use Laravel and PHP. The author sells books, consulting and calls on the same site, though the article itself does not pitch them.

Claude Code (the author recommends the Max plan for heavy use), Chrome, an existing codebase with a test suite and a separate test database.

Start with the deny list and a separate test database before giving the agent longer unattended loops.

• The Bootstrapped Founder (Arvid Kahl) ↗ Firsthand write-up, published February 6, 2026

Source published: February 6, 2026. Last reviewed here: November 1, 2026. Spot a mistake? Tell us.