Master GPT-5 Prompts: From Basic to Chain-of-Thought in 20 Minutes

# Prompt
"Write a Python function to validate email addresses"

# Problem: No context, no constraints, generic output

# Prompt
"""
Write a Python function to validate email addresses.

Requirements:
- Support RFC 5322 standard
- Handle international domains
- Return boolean and error message
- Include type hints
"""

# Better, but still doesn't leverage GPT-5's reasoning

# Prompt
"""
Create an email validator. Before coding, think through:

1. What edge cases exist in email validation?
2. Which validation approach balances strictness with UX?
3. What are common security concerns?

Then implement with your reasoning visible in comments.
"""

# Unlocks GPT-5's analytical capabilities

# Prompt
"""
Task: Email validation function for production API

<reasoning>
1. List 5 edge cases for email validation
2. Identify security risks (injection, DoS)
3. Choose validation strategy with trade-offs
4. Plan error messaging for users
</reasoning>

<implementation>
- Language: Python 3.12+
- Style: Type-safe, documented
- Testing: Include pytest examples
- Performance: Handle 10k validations/sec
</implementation>

<constraints>
- No external libraries for core logic
- Must work offline
- Return structured ValidationResult
</constraints>

Show your reasoning, then implement.
"""

# Instead of:
"Write a binary search tree"

# Use:
"""
Implement a binary search tree. First, reason through:

<analysis>
- What operations need O(log n) guarantee?
- How do we handle imbalanced trees?
- Should we use recursive or iterative approaches?
</analysis>

Then implement with your reasoning as inline comments.
"""

# Prompt
"""
Create a REST API endpoint for user authentication.

Output format:
<security_analysis>
[List threats and mitigations]
</security_analysis>

<code>
[Implementation with inline security notes]
</code>

<test_cases>
[Attack scenarios to test]
</test_cases>
"""

# Prompt
"""
Task: Optimize this SQL query

Example 1:
<query>SELECT * FROM users WHERE email LIKE '%@gmail.com'</query>

<reasoning>
- LIKE with leading wildcard prevents index use
- Full table scan on large tables
- Better: Hash domain, index it
</reasoning>

<optimized>
SELECT * FROM users WHERE email_domain = 'gmail.com'
-- Add index: CREATE INDEX idx_domain ON users(email_domain)
</optimized>

Now optimize:
<query>SELECT * FROM orders WHERE created_at > NOW() - INTERVAL 30 DAY</query>
"""

# Prompt
"""
Create a rate limiter middleware.

After implementation:
<verification>
1. Walk through the algorithm step-by-step
2. Identify failure modes
3. Suggest load testing approach
4. Rate your own solution's production-readiness (1-10)
</verification>

Be honest about limitations.
"""

# Multi-turn conversation
# Turn 1:
"""
Design a caching strategy for a real-time dashboard.
Only provide high-level architecture, no code yet.
"""

# Turn 2:
"""
Good. Now identify the 3 biggest risks in your design.
For each, propose a mitigation.
"""

# Turn 3:
"""
Implement the cache invalidation logic with your mitigations built in.
"""

# Prompt
"""
Implement JWT authentication with these constraints:

<must_have>
- Rotate secrets every 24h
- Revocation support
- Stateless verification
</must_have>

<cannot_use>
- Database for every token check
- Synchronous external calls
- Tokens >512 bytes
</cannot_use>

<trade_offs>
Explain what you sacrifice to meet these constraints.
</trade_offs>
"""

# Prompt
"""
Create a file upload handler.

<threat_model>
Before coding, list:
1. OWASP Top 10 risks that apply
2. Input validation points
3. Resource exhaustion vectors
</threat_model>

Then implement with security controls inline.
Mark each control with // SECURITY: [threat]
"""

# Run this evaluation
"""
Task: [Your coding task]

After completion:
1. Generate 5 test cases (3 happy path, 2 edge cases)
2. Predict failure modes
3. Estimate test coverage %
"""

"""
Task: Stripe webhook processor for production

<reasoning>
1. What can go wrong?
   - Malformed JSON
   - Replay attacks
   - Signature verification failures
   - Duplicate events
   
2. How do we ensure reliability?
   - Idempotent processing (event ID tracking)
   - Signature verification first
   - Structured logging
   - Dead letter queue for failures

3. Performance requirements?
   - Must respond <300ms (Stripe timeout)
   - Handle 1000 events/min spike
</reasoning>

<implementation>
Language: Python 3.12 with type hints
Framework: FastAPI
Storage: Redis for deduplication
Error handling: Exponential backoff, DLQ
</implementation>

Implement with your reasoning visible in comments.
"""

# Bad
"Add error handling to the function"
# Which function? What errors?

# Good
"Add error handling to the email validator from message #3.
Handle: invalid format, DNS lookup failure, network timeout"

# Bad: Taking the first response
model.generate("Create a cache")

# Good: Multi-step refinement
response1 = model.generate("Design a cache (architecture only)")
response2 = model.generate(f"Review this design: {response1}. What breaks under load?")
response3 = model.generate(f"Implement with fixes: {response2}")