Best practices guides for developers

A practical guide to writing TypeScript that catches real bugs without fighting you. It covers compiler settings for TypeScript 6 and 7, modeling data with types, avoiding unsafe escape hatches, validating data at runtime boundaries, generics, typed linting and organizing larger codebases, with short examples you can copy.

• Web
• Frontend
• Backend
• Programming

A practical guide to threat modeling for development teams who want it to be a normal part of design, not a yearly workshop. It covers the four questions, data flow diagrams and trust boundaries, STRIDE and abuse cases, rating and responding to threats, turning them into tickets and tests, keeping models current, and threat modeling features built on language models and agents.

• Security
• Backend
• AI

A practical guide to writing tests that catch real bugs and stay cheap to maintain. It covers choosing the right level for each test, unit test design, mocks and other test doubles, integration and end-to-end tests, flaky tests, coverage and mutation testing, and keeping the suite fast in CI. The advice is language agnostic, with examples in TypeScript and Python.

• Web
• Testing
• Programming

A practical guide to Terraform best practices for people who manage cloud infrastructure as code. It covers structuring and formatting configuration, pinning Terraform, providers and modules, storing state remotely with locking, keeping secrets out of state, writing modules and refactoring them safely, and a review workflow with plans, tests and policy.

• DevOps
• Cloud

A practical guide to the writing engineers do every week, checked against Google's free technical writing courses, the Diátaxis documentation framework, Google's engineering practices on change descriptions and GitHub's documentation. It covers audience and purpose, clear sentences, structure, design docs, READMEs and documentation, pull request descriptions, async updates, blog posts and editing.

• Career

A practical guide for engineers becoming tech leads, checked against Google's published engineering practices, the Google SRE book, Google re:Work research on team effectiveness and the ADR community. It covers defining the role with your manager, setting technical direction, planning and unblocking delivery, code review standards, growing the people on your team, handling incidents without blame, and communicating with stakeholders.

• Career
• Leadership

A practical guide to Spring Boot best practices for Java developers building REST services. It covers versions and the new modular starters, dependency injection and structure, typed configuration, the web layer and error responses, JPA and transactions, virtual threads, securing Actuator, testing with slices and Testcontainers, and running cleanly in production.

• Web
• Backend
• Programming

A practical guide to secure coding for developers who write server-side code in TypeScript, Node.js or Python. It covers trust boundaries and input validation, injection of every kind, output encoding, safe parsing and deserialization, file uploads, path traversal, server-side request forgery, error handling that fails closed, and dependency hygiene, mapped to the OWASP Top 10:2025 and ASVS 5.0.

• Security
• Backend
• Programming

A practical guide to secrets management for developers who build and deploy apps. It covers where secrets should live, keeping them out of git and catching leaks, least privilege, rotation, CI/CD with OIDC instead of long-lived keys, what the browser can and cannot see, log redaction, and what to do in the first hour after a leak.

• Security
• DevOps

A practical guide for developers building a small software product on the side or full time. It covers validating demand by talking to users, scoping an MVP you can ship in weeks, pricing and packaging, onboarding and activation, the subscription metrics that matter defined the way Stripe Billing defines them, support and retention, a steady shipping cadence, and deciding honestly when to keep going or stop.

• Career

A language-agnostic guide to REST API design for developers who build HTTP APIs that other teams, apps or customers depend on. It covers resource and URL design, HTTP method semantics, status codes, RFC 9457 error responses, payload conventions, pagination and filtering, idempotency and concurrency control, and versioning, deprecation and documentation with OpenAPI.

• Web
• Backend

A practical guide to building React Native apps the way the React Native and Expo docs recommend today. It covers project setup and upgrades, components and styling, lists, performance and threads, navigation and deep links, security and storage, accessibility, and testing and release, with short examples you can copy.

• Web
• Mobile
• Frontend

A practical guide to writing React the way the React team recommends today. It covers components and purity, state, effects, performance with React Compiler, React 19 form actions, accessibility, testing and project hygiene, with short examples you can copy.

• Web
• Frontend

A practical guide to Python best practices for people who write applications, services and scripts that other people depend on. It covers supported versions and project setup with pyproject.toml and a lockfile, style with PEP 8 and Ruff, type hints and data modelling, error handling, logging, concurrency and performance, testing with pytest, and the security mistakes Python makes easy.

• Web
• Programming
• Backend

Vendor-neutral prompt engineering best practices, checked against the official prompting guides from Anthropic, OpenAI and Google. It covers clear instructions, prompt structure and long context, few-shot examples, reasoning and prompt chaining, output and parameter control, and how to test, iterate on and maintain prompts as models change.

• AI

A practical guide to PostgreSQL best practices for application developers. It covers schema design and data types, constraints, indexing with EXPLAIN, query patterns that avoid N+1 problems, migrations that do not lock production, connection pooling, transactions and isolation, backups you have actually restored, and roles with least privilege.

• Web
• Databases
• Backend

A practical guide to personal branding for software developers. It explains what a developer brand actually is, how to choose a focus, how to keep your profiles consistent, why proof of work beats claims, how to write and share what you learn, how to engage with other people, how reputation compounds over years, and how to avoid hype and burnout along the way.

• Career
• Personal branding

A practical guide to observability best practices for teams running services in production. It covers choosing what to measure with SLIs and SLOs, designing metrics that stay cheap, writing logs you can search and join to traces, instrumenting with OpenTelemetry, running a telemetry pipeline, and alerting on user pain instead of noise.

• DevOps
• Backend

A practical guide to building and running Node.js APIs in production, checked against the Node.js docs, the Express production guides and the OWASP Node.js cheat sheet. It covers structure and config, validation and errors, async code, security, logging, testing, performance and shutdown.

• Web
• Backend

A current guide to building with the Next.js App Router, checked against the Next.js 16.4 docs. It covers Server and Client Components, the Cache Components model with use cache, securing Server Actions, proxy.ts, metadata, images and keeping your app up to date.

• Web
• Frontend
• Backend

A practical guide to MongoDB best practices for application developers. It covers supported versions, schema design around access patterns, schema validation including the new constraint level in 9.0, compound indexes with the ESR guideline, queries and aggregation within memory limits, write concern and transactions, driver connection handling, and the security checklist for a production deployment.

• Web
• Databases
• Backend

Best practices for building and evaluating a machine learning model before it goes anywhere near production, checked against the scikit-learn and PyTorch documentation, Google's Rules of Machine Learning and ML Crash Course, MLflow and Fairlearn. It covers problem framing and baselines, data splits and leakage, features, training and tuning, metrics and error analysis, reproducibility and experiment tracking, and fairness checks.

• Data
• Machine learning

Vendor-neutral best practices for building LLM apps and agents, checked against the OWASP Top 10 for LLM Applications 2026, the OWASP Agentic Top 10, NIST's Generative AI Profile and official provider docs. It covers prompt design, evals, prompt injection, agent permissions, cost, observability, failure handling and data privacy.

• AI
• AI agents

A practical guide to learning a new programming language, framework or tool efficiently, checked against official documentation such as the Rust Book, the Tour of Go and the Python tutorial, a major review of learning techniques in psychology, and Anthropic's 2026 randomised study on AI assistance and coding skills. It covers setting a goal, starting from official docs, building small projects, deliberate practice, remembering what you learn, reading real code and learning with AI assistants without outsourcing your understanding.

• Career
• Programming