Project structure · Backend
Flask project structure
Opens with creditsThe Flaskr blog from the official Flask tutorial, grown into a real app: an application factory, blueprints for auth, blog and a JSON API, Flask-SQLAlchemy models with Flask-Migrate migrations, services shared by views and API, and pytest from the tutorial's fixtures up to Playwright and contract tests. For students who finished the tutorial and want to know what the next fifty files look like.
Curated by Tauseef FayyazBeginner137 files and foldersFlask 3.1, Werkzeug 3.1, Python 3.14Checked October 2026How it grows
Each stage opens the explorer there
- 1Day 1What the scaffold and your first hour give you27 files and folders
- 2GrowingWhat a real app with features and tests adds+62 files and folders
- ProductionWhat running it for real users adds+26 files and foldersOpens with credits
- ExpertWhat a team needs to keep it healthy for years+22 files and foldersOpens with credits
How it is organised
- Use the application factory from day 1: `create_app()` builds a fresh app, so tests, the CLI and Gunicorn each get one configured the way they need.
- One blueprint per area of the site (auth, blog, api). A blueprint starts as one module and becomes a package when it grows, without changing how it is registered.
- Extensions are created once in `extensions.py` and bound to the app inside the factory with `init_app`, which avoids circular imports.
- Views stay thin: read input, call a service, render or redirect. Services hold the rules so the HTML views, the JSON API and CLI commands share them.
- Configuration comes in layers: safe defaults in `config.py`, local secrets in the gitignored `instance/` folder, production values from `FLASK_*` environment variables.
- Schema changes are migrations. The tutorial's `schema.sql` is for learning; once data matters, Flask-Migrate records every change.
- Escape by default, protect every form: Jinja autoescaping, CSRF tokens through Flask-WTF, secure session cookies and security headers.
- Tests grow with the app: the tutorial's fixtures and test client first, then services and API, then real PostgreSQL and a browser, then contract and load tests.
At the top of the project
Open one in the explorer for the full story
- flask-tutorial/
- .venv/The virtual environment uv creates, with Flask and its dependencies.
- .git/Git history, created with `git init`.
- .gitignoreFiles never to commit: the venv, bytecode, `instance/`, coverage output, build folders.
- .python-versionThe Python version uv uses for this project, written by `uv python pin`.
- pyproject.tomlProject name, dependencies, and settings for pytest, coverage, Ruff and mypy.
- uv.lockExact versions of every installed package, written by uv.
- README.mdHow to install, run, test and deploy the app.
- flaskr/The application package: code, templates and static files all live in here.17 inside
- instance/Local, per-machine files: the SQLite database and secret config. Never committed.2 inside
- tests/pytest tests, from the tutorial's fixtures to integration and browser tests.11 inside
- MANIFEST.inTells setuptools to include non-Python files (templates, static, schema.sql) in a built package.
- migrations/Alembic migrations managed by Flask-Migrate.5 inside
- .flaskenvPublic Flask CLI settings such as `FLASK_APP=flaskr`, loaded by python-dotenv.
- .envLocal secrets and URLs, read by the Flask CLI through python-dotenv.
- .env.exampleEvery variable the app needs, with placeholder values. Committed.
- compose.yamlPostgreSQL and Redis for local development, later the app and worker too.
- make_celery.pyThe Celery entry point from the Flask docs: `celery -A make_celery worker`.
- .vscode/Shared VS Code settings: interpreter, Ruff, and a Flask debug profile.2 inside
- .editorconfigIndentation and line ending rules for every editor.
- .pre-commit-config.yamlRuns Ruff and basic file checks before each commit.
- MakefileShort names for long commands: `make dev`, `make test`, `make migrate`.
- htmlcov/The HTML coverage report from `pytest --cov --cov-report=html`.
Learn more on Sefism
Roadmaps, cheat sheets and projects that go with Flask.
- Roadmap· PythonBackend development roadmapAPIs, databases, auth, deploys
- RoadmapSQL and databases roadmapQueries, design, indexes, transactions
- Roadmap· API testingQA and test automation roadmapManual testing to automated suites
- Cheat sheetBackend development cheat sheetAPIs, databases, auth, deploys.
- Cheat sheetSQL and databases cheat sheetQueries, design, indexes, transactions.
- FYP idea· BeginnerTuition Centre Fee and Attendance Manager with Parent RemindersA web app for small tuition centres and academies to manage batches, take attendance from a phone, generate monthly fee vouchers and send parents reminders. A beginner-friendly final year project with a real paying customer in almost every neighbourhood.
- FYP idea· BeginnerBreached Password and Credential Stuffing Guard Middleware for Small Web AppsBuild drop-in middleware for Express, Django or Laravel that protects login and sign-up forms in two ways: it refuses passwords that appear in known breaches using a privacy-preserving lookup, and it detects credential stuffing attacks from patterns across many login attempts. It is aimed at small e-commerce, school and clinic sites that cannot afford an enterprise bot management product.
- FYP idea· IntermediateSchool Report Card System with Configurable Grading Rules and Batch PDFsA web system for private schools to enter marks, apply their own grading and promotion rules, moderate results and generate hundreds of printable report cards in one batch. An intermediate final year project in education software with a real rules engine and a document generation pipeline.
- QuestionI understand tutorials but cannot build anything myself. Why does coding feel so different when I am alone?Tutorials train recognition, not production. When you follow along, someone else makes every decision. Building alone requires you to break a problem down and make choices, which is a separate skill. Build it with small projects, planning on paper first, and a rule to struggle before you look anything up.
See 6 moreShow fewer
- QuestionShould I learn Python or JavaScript first?Choose based on what you want to build. JavaScript if you want web development, since it runs in every browser. Python if you are drawn to data, AI, automation or backend scripting. Both are excellent first languages, and the second one is far easier once you know the first well.
- QuestionHow do I learn Git and GitHub properly instead of just copying commands?Learn the model first: commits are snapshots, branches are pointers, and remotes are copies. Then use Git daily on your own projects, practise a team workflow with branches and pull requests, and break things on purpose, such as merge conflicts, so you learn to recover calmly.
- Resource· Guidepytest DocumentationThe official documentation for pytest, the most widely used Python testing framework. It shows how to write tests as plain functions with ordinary assert statements, share setup through fixtures, run one test against many inputs, and extend the tool with plugins. The twenty-minute getting started guide is enough to put tests around a small project, and the rest works as a reference as your suite grows.
- Resource· Tooluv DocumentationThe official docs for uv, the fast Python package and project manager from Astral. It replaces pip, virtualenv, pip-tools and pyenv for most projects, and its lockfile is what makes an ML project install the same way on your laptop, in CI and in a Docker image. Free, open source and quick to learn.
- Resource· GuideDocker Docs: Get StartedDocker's official starting point: install Docker, follow a tutorial that builds, runs and shares a containerised application, then work through short concept pages on containers, images, registries, Compose, image layers, Dockerfiles, the build cache, multi-stage builds, ports and persistent data. It suits developers who have heard of containers but never used them, and it is current, free and more accurate than most tutorials copied from it.
- Resource· Cheat sheetOWASP Cheat Sheet SeriesThe OWASP Cheat Sheet Series is a free collection of short, expert-written guides on specific security tasks, such as authentication, session management, password storage, input validation, JSON Web Tokens, REST security, XSS and SQL injection prevention. It suits developers who need to implement something securely right now and want a concise list of what to do and which mistakes to avoid, rather than a textbook.
Checked against 20 official sources, October 2026. If something has changed, the docs win.Show sourcesHide sources
- Flask tutorial
- Flask tutorial: Project Layout
- Flask: Application Factories
- Flask: Large Applications as Packages
- Flask: Configuration Handling
- Flask: Background Tasks with Celery
- Flask: Tell Flask it is Behind a Proxy
- Flask: Deploying with Gunicorn
- Flask: Security Considerations
- Flask-SQLAlchemy quick start
- Flask-Migrate documentation
- Flask-WTF: CSRF protection
- Flask-Limiter documentation
- flask-smorest documentation
- uv: Creating projects
- uv: Using uv in Docker
- pytest-playwright
- Testcontainers for Python
- Schemathesis documentation
- import-linter documentation
Best practices and checklists for this stack
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
Work with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com