"Find the following vulnerabilities in this codebase:
1. Possible SQL Injection points
2. XSS-prone rendering
3. Authentication bypass paths
4. Sensitive data being logged
5. Path Traversal For each finding: file:line, severity (H/M/L), suggested fix"

- **Prompt caching**: Use Anthropic's cache. Re-ingesting the same 1M tokens can receive a 90% discount
- **Selective ingestion**: Include only the files relevant to the analysis (exclude tests, vendor code, minified bundles)
- **Sonnet first**: Sonnet 4.6 is enough for simple aggregation and summarization — reserve Opus for complex reasoning ## Caveats 1. **Lost in the middle**: Even with 1M context, accuracy can drop for content placed in the middle. Put critical information near the beginning or end
2. **Code token efficiency**: Removing comments and trimming whitespace can let you fit 30% more code
3. **Single-prompt limits**: For lengthy analyses, ask for partial responses Suspense-style ## 💡 Real-World Insight Most articles stop at the generic claim that "1M context = automatically better," but the real blocker Korean developers run into is **cost structure and cache hit rate**. After using this for six months on an in-house monorepo of about 500,000 lines (Spring + React), I found that the monthly bill reached $300–$500 without aggressive Prompt Caching. Costs only settled around $40–$60 per month after I started segmenting `cache_control` blocks at the codebase boundary and asking repeated questions within the 5-minute TTL. Another point that is often missed in Korean developer communities (OKKY, Disquiet) is that **reusing your `.gitignore` patterns to exclude vendor/dist/lockfile** reduces tokens by roughly 35% on average (per the 2025 GitHub Octoverse, about a third of an average repo's size is lockfiles and build artifacts). Finally, the biggest practical time savings do not come from "full analysis," but from **per-PR diff analysis** (load only the base branch + diff, roughly 50K–150K tokens). That is the most realistic way to automate code review without building RAG infrastructure. ## Wrap-up 1M context opens up many cases where "you don't need RAG." You can start immediately without chunking or embedding infrastructure, which improves MVP velocity. If you manage the cost side carefully, it can be a game changer for individuals and small teams working with large codebases. ## Practical Prompt Template Collection **Legacy Code Architecture Analysis Prompt**

|---------|---------|---------|----------------|
| Full analysis of 50K lines of code | 800K | 5K | ~$12.4 |
| With Prompt Cache | 800K (90% cached) | 5K | ~$1.6 |
| 10 follow-up questions | 800K × 10 (cached) | 50K | ~$13.5 | With Prompt Caching, repeated work can cut costs by 80–90%. ## Limits of 1M Context and How to Work Around Them **Limit 1: Lost-in-the-middle effect**
Information placed in the middle of the context is less likely to be handled accurately. Put important code or explanations at the beginning or the end of the prompt. **Limit 2: Slow long-form generation**
After a 1M token input, generation can take 30–60 seconds. The streaming API gets the first token out quickly and improves UX. **Limit 3: Lower code accuracy at scale**
Once you go beyond 50K lines of code, the error rate rises when the model has to point to a specific function precisely. Re-quote critical functions explicitly in the prompt. **Workaround: Tree-sitter preprocessing**
Using a code parser (tree-sitter) to extract the AST first and pass only compressed structural information improves token efficiency by 40–60%. ## Frequently Asked Questions **Q. Can I use the 1M context directly from the Claude Code CLI?**
A. Yes. Specifying Opus with `claude --model claude-opus-4-7` automatically activates the 1M context. It is useful for analyzing large-scale codebases. **Q. Can I include images in 1M tokens?**
A. Yes. A single image consumes roughly 1,000–2,000 tokens. Attaching diagrams or screenshots can complement your code context.