The library
Every concept a real engineer owns
Short, plain-language videos — what each thing is, how it breaks in production, and what you tell the AI when you build it. The full map is below; videos unlock as they render.
3 live · 22 in production — every concept listed below.
Start here — Foundations
D1 · Identity & Access
4:301Authenticationpasswords & hashingbrute-forcesessions & tokens2FApassword resetOAuthaccount enumeration
2Authorization & access control in productionroles / RBACIDOR & object ownershipmulti-tenant data isolation
D2 · Data, Lists & APIs
3Pagination & lists in productionoffset vs cursor paginationfiltering & sortingautocomplete / typeaheadinfinite-scroll vs pages
4Building a solid API in productionrate limiting & abuseerror contracts & status codesversioningbulk operationsreceiving webhookssoft-delete & data lifecycle
D3 · State, Consistency & Correctness
5Concurrency & race conditions in productiontransactions & atomicityrace conditions & lockinglost updatesunique constraints & dedup
6Data correctness in productionN+1 & indexeseventual consistencyclient + server validationtime & timezonesforms & double-submit
D4 · Frontend Under Real Conditions
7Frontend states & UX in productionlist keysloading / empty / error statesoptimistic UIstale-response racesdebounce & throttleclient cache
8Inclusive & resilient frontend in productionaccessibility (a11y)i18n / localizationoffline & flaky networks
D5 · Money & Commerce
9Payments done right in productiongateway / UPIidempotency & double-paymentreconciliationrefundsstoring moneyledgers
10Pricing & subscriptions in productionpricing / GST / coupons / currencysubscriptions, renewals & dunning
D6 · Reliability & Async
11When things fail in productionbackground jobs & queuestimeouts, retries & backoffcircuit breakersemail / SMS / push deliverysending webhooks
12Caching & real-time in productioncaching & invalidationwebsockets & reconnection
D7 · Security
13Web security essentials in productioninput validationXSSSQL / NoSQL injectionCSRFCORSmass-assignment
14Infra & data security in productionsecrets & configSSRFfile-upload securitysecurity headers / HTTPS / cookies
D8 · Files, Media & Search
15Files, uploads & media in productionfile uploadsupload securityimage processing & thumbnailsCDN & signed URLs
16Search & big exports in productionfull-text search & relevancelarge exports & streaming
D9 · Observability & Operations
17Observability in productionPII-safe loggingmonitoring & alertingaudit logserror tracking
18Shipping safely in productionfeature flags & gradual rolloutzero-downtime migrations
D10 · Scale, Cost & the Real World
19Scale & cost in productionDB scaling (replicas / pools)cloud cost & quotasthird-party & vendor failureenv & config drift
20Compliance & analytics in productionDPDP / GDPR — deletion, export, consentanalytics & event-tracking correctness
D11 · AI-Era Engineering
21Building AI features in productionprompt injection & jailbreaksLLM cost & limitsLLM output reliability
22Working with AI-written code in productionreviewing an AI-generated PRthe test that tests nothing
D12 · Foundations
23Foundations the demo skips in productionschema & data modelingbackups & restore drills
Three real tickets, reviewed like production — free, no card.
Start the Trail →