- Sep 10, 2026 7 min read
Give everything only the keys its job needs
One of the biggest card breaches in history started with an air-conditioning contractor who had far more access than they needed. The principle that would have stopped it is simple: every user, token, and piece of code gets only what it needs, nothing more. Here is least privilege, and why it is really a bet on the day something leaks.
- Sep 10, 2026 7 min read
Ship the code, reveal the feature later: what feature flags really do
The scariest part of shipping is that deploy and launch happen at the same instant. Feature flags split them apart: the code goes to production switched off, and you turn it on later, for a few users first, and off again in a second if it breaks. Here is how they work and the debt they quietly build.
- Sep 10, 2026 5 min read
What the version number is actually trying to tell you
You update a package and your app breaks, or you are too scared to update anything at all. The three numbers in 2.14.3 were telling you whether that update was safe, if you knew how to read them. Here is semantic versioning, the caret and tilde that trip everyone up, and why the whole promise rests on trust.
- Sep 10, 2026 8 min read
Why clicking pay twice should not charge you twice
Your payment request times out. Did it go through? If you hit retry, will you be billed twice? The answer to that everyday panic is one word, idempotency, and it is a fundamental every backend needs. Here is what it means and how it is actually made safe.
- Sep 10, 2026 7 min read
Your password is not encrypted, and that is a good thing
Encoding, encryption, and hashing all turn readable data into gibberish, so people use the words interchangeably. They do opposite jobs, and mixing them up is behind real breaches. Here is the difference, why a good site hashes your password instead of encrypting it, and why Base64 is not a lock.
- Sep 08, 2026 8 min read
The one-page note that answers 'why did we build it this way?'
Your code shows what a project does. It never shows why you chose this database, this framework, this shape. An Architecture Decision Record is a short file that captures that why, once, so nobody has to guess or re-argue it later. Here is what goes in one, when to bother, and the single rule that makes them worth keeping.
- Sep 08, 2026 8 min read
AI writes the code fast, but the security is still your job
AI-generated code looks finished and often is not safe. Recent analysis found nearly half of it ships an OWASP Top 10 flaw. This is the beginner's security baseline: the handful of things you have to check yourself, because the AI will not add them for you.
- Sep 08, 2026 12 min read
The 15-year-old checklist that still catches your deployment bugs
The Twelve-Factor App is a list of twelve habits for building software that runs the same everywhere. It was written in 2011 and still explains most of why an app breaks in production. Here is the whole thing in plain terms, grouped so it sticks, plus the four factors that show their age in 2026.
- Sep 06, 2026 6 min read
Three tools that keep a growing front end from becoming a mess
Raw HTML and JavaScript are fine for one page. Stop three on the roadmap is what you reach for when one page becomes fifty: components, a package manager, and a way to talk to other services.
- Sep 06, 2026 6 min read
Handing the model the right page before it answers
A model only knows what it was trained on. To make it answer from your documents, you fetch the right passages and put them in front of it first. The fourth stop on the AI roadmap: RAG, and the handful of decisions that decide whether it actually works.
- Sep 06, 2026 6 min read
When using a model is not enough, and you want to shape one
Everything on this roadmap so far used models as they come. The last, optional stop is what lies underneath: how they are trained, when fine-tuning actually beats prompting, and how to run one on your own machine.
- Sep 06, 2026 7 min read
The setup that comes before any project, and why tutorials skip it
Every tutorial starts at 'create a new project'. Real work starts earlier, with the terminal, the editor, the keys, and the Git habits you use every single day. The first stop on the full-stack roadmap is the bench you build on.
- Sep 06, 2026 6 min read
Launch is the start line, not the finish
Getting an app online is the easy half. The final stop on the roadmap is everything that keeps it standing afterwards: deploying, testing, and the maintenance nobody warns you about.
- Sep 06, 2026 7 min read
How to ask a model so it answers well, and does not bill you twice
Calling a model from code is easy. Getting a reliable, structured, affordable answer is the actual skill. The third stop on the AI roadmap: prompts that work, and the three cost levers most beginners never touch.
- Sep 06, 2026 7 min read
Why every serious app needs a back end you cannot see
The front end is the part you can inspect, change, and lie to. A later stop on the roadmap is the half that has to assume you are lying: the server, its rules, and how a login actually keeps a password safe.
- Sep 06, 2026 7 min read
A language model is autocomplete that read the whole internet
Before building on a model, it helps to know what it is doing when it answers. The second stop on the AI roadmap: tokens, prediction, the memory limit, the dials, and why it confidently makes things up.
- Sep 06, 2026 6 min read
Two ways to store data, and one way to not get robbed
A database is how an app remembers anything after you close the tab. A stop on the roadmap: the two shapes data comes in, how to pick one, and the one-line habit that keeps a stranger from reading your whole database.
- Sep 06, 2026 6 min read
The habits that make a team able to rely on you
Knowing how to code gets you hired. What keeps you on a team is a different set of skills, none of them technical: reviewing, writing things down, breaking work into pieces, and saying what you do not know. A stop on the full-stack roadmap about the job around the code.
- Sep 05, 2026 6 min read
What one press of Enter really sets off
Type a web address, press Enter, and a page appears. In the half second between, four separate systems do their jobs. An early stop on the roadmap: how the web actually works.
- Sep 05, 2026 7 min read
The three languages hiding in every web page
Every page you have ever opened is made of three languages doing three different jobs. An early stop on the roadmap: what HTML, CSS and JavaScript each do, and why TypeScript joined the team.
- Sep 04, 2026 7 min read
The docs a project actually needs, from solo to serious
Inheriting a codebase with no documentation is the fastest way to learn why it exists. Here is what each document answers, and how the set grows from a one-person project to a professional one.
- Sep 03, 2026 7 min read
Where your website's words actually live
A CMS used to be the default first purchase for any website. It is not anymore. Here are the three places your content can live, and an honest way to pick one.
- Sep 02, 2026 8 min read
CLI, API, or MCP: how AI actually touches your software
When you give an AI agent access to your tools, it crosses one of three bridges. Each one has a different price, a different failure mode, and a different reason to exist.
- Sep 01, 2026 8 min read
Vibe coding is a skill stack, not a shortcut
Describing an app to an AI and getting working code feels like magic. The people it actually works for are quietly doing four things the demos never show.