Sefism Backend Development Cheat Sheet

What it is

The Backend development cheat sheet is the quick-revision companion to Sefism's Backend development roadmap, for anyone building the server side of real products. It covers HTTP, SQL, API design, security, caching and queues, testing and deployment, and architecture, with an essentials chapter for your own language and framework at the front.

Each concept is a short card: what it is, why it matters, an example or snippet where one helps, and the mistake people usually make. It is for revision, not first learning. You meet each idea properly in the roadmap, then come back here when you need it sharp again: before a project, an exam or a technical conversation. A glossary at the back refreshes any term you half remember.

Seven editions

The sheet has an edition for each stack the roadmap supports, and the first chapter changes with it:

• Node.js and TypeScript: the event loop, promises and async/await, TypeScript types, npm and lockfiles, NestJS controllers, providers and modules, and JavaScript core. 75 concepts in the edition.
• Python: async/await and ASGI, the GIL, virtual environments, pip and uv, type hints, Django URLs, views and apps, and Python core. 76 concepts.
• Java and Spring Boot: beans and dependency injection, records, virtual threads, @RestControllerAdvice, Maven and Gradle, and Java collections. 76 concepts.
• C# and ASP.NET Core: async/await and Task, the DI container and service lifetimes, nullable reference types, LINQ and the dotnet CLI. 75 concepts.
• Go: errors as values, implicit interfaces, goroutines and channels, context.Context and Go modules. 74 concepts.
• PHP and Laravel: the PHP request lifecycle, modern types and enums, Composer, the Laravel service container and Eloquent. 76 concepts.
• Rust: ownership and borrowing, enums and pattern matching, Result and the ? operator, traits, Cargo, async on Tokio, Arc and Mutex, Axum and SQLx. 78 concepts.

The eight chapters after it are shared by every edition, so the database, API and architecture material reads the same whatever language you work in.

Chapter by chapter

1. Your stack's essentials

The language and framework features every service in your stack depends on, as listed above.

2. Terminal and Git

A short chapter on the two tools every backend task starts with: terminal essentials, Git commits and branches, and pull requests. For more depth, the Linux, terminal and Git cheat sheet covers them in full.

3. How HTTP works

DNS, TCP and TLS, the HTTP request and response, methods with safety and idempotency, status codes, and HTTP/1.1, HTTP/2 and HTTP/3.

4. Relational databases and SQL

Joins, GROUP BY and aggregates, keys and constraints, data modelling and normalisation, indexes, EXPLAIN and query plans, transactions and ACID, isolation levels and locking, schema migrations, and ORMs with the N+1 query problem.

5. Designing and building APIs

REST resources and route handlers, request validation, one error shape with Problem Details, pagination, filtering and sorting, idempotency keys and safe retries, versioning, OpenAPI, REST against GraphQL and gRPC, webhooks and CORS.

6. Authentication and API security

Authentication against authorisation, password hashing, sessions and cookies, JWT access and refresh tokens, OAuth 2.0 and OpenID Connect, role and object-level authorisation, SQL injection and parameterised queries, rate limiting, HTTPS and security headers, and the OWASP API Security Top 10.

7. Caching, queues and performance

Latency percentiles (p50, p95, p99), cache-aside with Redis, TTLs and invalidation, cache stampedes, HTTP caching and CDNs, message queues and background workers, at-least-once delivery with idempotent consumers, connection pooling, reverse proxies and TLS termination, and read replicas.

8. Testing, CI/CD and deployment

Test levels, testing an endpoint, testing against a real database, mocks, stubs and fakes, Dockerfiles and images, Docker Compose, GitHub Actions, config and secrets from the environment, liveness and readiness checks, and deploy strategies with rollbacks.

9. Architecture and reliability

Monolith first and service boundaries, API gateways and backend for frontend, service discovery and sidecars, timeouts, retries and backoff, circuit breakers, sagas, the transactional outbox, CQRS, logs, metrics and traces, and replication, sharding and failure modes.

Most chapters link up to three library resources for depth, such as OWASP API Security Top 10, the Redis documentation, RabbitMQ Tutorials, The Twelve-Factor App and Hussein Nasser: Backend Engineering.

Rules of thumb worth remembering

Nine rules are shared and three belong to a single edition. A few:

• Write the SQL by hand first, then check what your ORM generates for the same query.
• Every outbound call needs a timeout, and every retry needs backoff and an idempotent operation.
• Check authorisation on every endpoint for the specific record, not just that the caller is logged in.
• Make migrations backward compatible so the previous release can still run and you can roll back.
• Put a trace or request ID in every log line, and never log secrets or personal data.
• Start with a well-structured monolith; split out a service only for a concrete reason.

The Node.js, Go and Rust editions each add one about keeping blocking work off the event loop or async runtime, or about passing context and knowing how every goroutine stops.

How to use it with the roadmap

• After each stage: stage 1 of the roadmap maps to the first three chapters, and each later stage to one chapter. Read it without notes and check every pitfall line.
• While building: keep the security chapter open when you add login, and the caching chapter open when you add Redis. Most bugs at those stages are listed as pitfalls.
• Before a technical conversation: the HTTP, SQL, API and caching chapters are the ones to reread, with ideas you should be able to explain aloud, such as idempotency, isolation levels and cache invalidation.
• When reviewing a pull request: the rules of thumb work as a short checklist.

How it works on Sefism

Everything here is free to learn from. The public page lists every chapter title, with the first chapters open to read. Keeping the sheet uses credits, and new members get starting credits when they join. Adding the Backend development roadmap to your dashboard (your first roadmap is free) opens this sheet with it. In the member area you can switch between the seven editions.

Related on Sefism

• Sixteen things that break a backend
• Microservices practices that actually keep them workable
• Should I learn Rust or Go?
• The SQL and databases cheat sheet for a deeper database chapter, and the Full stack development cheat sheet if you build the frontend too

FAQ

Is it enough to learn backend development from? No. It is a revision sheet; the roadmap and its resources do the teaching.

Which database does it assume? The SQL chapter follows the roadmap, which teaches PostgreSQL. Most of it applies to any relational database.

Can I read another stack's edition? Yes. Switching edition changes only the first chapter and a few tips, which makes it a quick way to see how another stack handles the same ideas.