Wire a form backend with Claude Code without leaking secrets

To wire a form backend with Claude Code, point it at a hosted, domain-locked endpoint and your public campaign id, and forbid secrets in the browser. Claude Code can edit files across your repo — the guardrail that matters is that the form uses the public pub_... id and never an ss_live_ key.

The prompt

Give Claude Code the endpoint, the public id, and the fields. Ask it to keep the honeypot and to remind you to allow-list each hostname afterwards.

Wire a contact form in this repo to Simple Signups (no backend of my own).

- Endpoint: https://simple-signups.com/api/subscribe
  (or path-style https://simple-signups.com/c/pub_your_campaign_id)
- Public campaign id only: pub_your_campaign_id. Never invent an id or a key.
- Fields: email (required), optional firstName/lastName, hidden honeypot name="hp".
- Keep all secrets out of the browser; do not add ss_live_ keys to client code.
- After wiring, remind me to allow-list each hostname that embeds the form (exact match).

Why Claude Code needs a review pass

Claude Code can touch multiple files in one pass: components, route handlers, tests, and docs. That is useful, but it also means a slightly vague prompt can produce a bigger diff than you expected. Treat it like a fast pair programmer, not an auto-merge bot.

Review before you ship

Confirm the action targets your campaign endpoint, the honeypot field is present and hidden, and no secret leaked into client code or the repo. The field and error reference is in the quickstart.

<form action="https://simple-signups.com/api/subscribe" method="POST">
  <input type="hidden" name="campaignId" value="pub_your_campaign_id" />
  <input type="email" name="email" required placeholder="you@example.com" />
  <input type="text" name="hp" tabindex="-1" autocomplete="off"
    style="position:absolute;left:-9999px" aria-hidden="true" />
  <button type="submit">Subscribe</button>
</form>

Checklist after repo-wide edits

• The endpoint is correct in every changed file.
• The form still posts the public campaign id, not a secret key.
• The hidden honeypot field is present and hidden from normal users.
• The final notes remind you to allow-list each embedding hostname.
• No secret appears in diffs, tests, docs, or commit messages.

Related

• How AI coding agents can add signup forms in seconds.
• Contact forms use case.