Gemini 3.5 Flash Has a 1M Token Context Window. Here's What You Can Actually Build With It.

from google import genai



client = genai.Client(api_key="YOUR_API_KEY")



response = client.models.generate_content(

    model="gemini-3.5-flash",

    contents="What's the most underrated pattern in async Python?",

)



print(response.text)

That's the baseline. Now the part that matters.

What 1M Tokens Actually Lets You Do

One million tokens is roughly 750,000 words. That's:

• The entire source code of a medium-sized web app


• Six months of Slack export from a busy engineering channel


• A 300-page legal agreement plus all its referenced attachments


• A full year of support tickets

Previously, reasoning over a full codebase meant chunking it, embedding it, retrieving relevant pieces, and hoping retrieval didn't miss the thing that mattered.

With 1M context, you just send it. One call. The model sees everything simultaneously.

Bold opinion: Most "RAG pipeline" complexity is a workaround for insufficient context window. 1M tokens doesn't eliminate RAG entirely, but it eliminates a huge class of retrieval problems for the applications most developers are actually building.

Tutorial: Whole-Codebase Code Review

Here's a real use case: feed your entire project to Gemini 3.5 Flash and get a structured security review.

import os

from pathlib import Path

from google import genai



client = genai.Client(api_key=os.environ["GEMINI_API_KEY"])



def load_codebase(root: str, extensions: list[str] = [".py", ".ts", ".js"]) -> str:

    parts = []

    for path in sorted(Path(root).rglob("*")):

        if path.suffix in extensions and ".git" not in path.parts:

            parts.append(f"\n\n### FILE: {path}\n")

            parts.append(path.read_text(errors="ignore"))

    return "".join(parts)



codebase = load_codebase("./src")



response = client.models.generate_content(

    model="gemini-3.5-flash",

    contents=f"""You are a security-focused code reviewer.



Review this entire codebase for:

1. SQL injection vulnerabilities

2. Unvalidated user input in system calls

3. Hardcoded secrets or credentials

4. Insecure direct object references

5. Missing authentication checks



For each issue: file path, severity (critical/high/medium/low), what's wrong, suggested fix.



Codebase:

{codebase}""",

)



print(response.text)

One API call. No chunking, no retrieval pipeline, no missed cross-file context.

The model sees api/routes.py and middleware/auth.py simultaneously — it'll catch a vulnerability that's only exploitable because a check is missing in auth.py, which chunk-based retrieval would likely miss.

I Tried It: Security Review on UXRay

I ran this on my own project — → sign in → API Keys → Create. Free tier, no billing required to test.

Model ID: gemini-3.5-flash. No suffix, no preview. That's the GA signal.

Gemini 3.5 Flash docs at .

Tags: googleio gemini ai python tutorial