Roadmap · Build products
Backend development (C#)
Opens with creditsFor people who can already write a little code and want to build the server side of real products in Node.js, Python, Java, C#, Go, PHP or Rust. By the end you can design a schema and an API, secure it, make it fast, test and ship it in containers, and explain the architecture choices behind it.
Curated by Tauseef Fayyaz7 stages, 70 topics~20 months at a few hours a weekBy the end, you will be able to
- Design a normalised PostgreSQL schema, write its queries by hand and prove with EXPLAIN that your indexes are used
- Build a documented REST API with pagination, idempotent writes, versioning and one predictable error shape
- Secure it with hashed passwords, short-lived access tokens and role checks, and review it against the OWASP API Security Top 10
- Add Redis caching and a queue-backed worker, then ship the service in Docker through a GitHub Actions pipeline with real tests
- Explain when an API gateway, circuit breaker, saga or CQRS earns its place, and trace one request across two services
The path
7 stages, in the order to learn them. Open one to start.
1Your language and how HTTP worksGet fluent in one backend language and its runtime, and learn exactly what happens between a client and your server. Everything later in this roadmap sits on these two things.10 topics · ~6 months
- 1The terminal and GitMost backend work happens in a terminal, the text window where you type commands (also called the command line or shell).
- 2The dotnet CLI and NuGetEverything in modern .NET starts from the dotnet CLI, a command-line tool that works on every operating system, so learn it on day one.
- 3C# syntax, classes and recordsC# is statically typed and object-oriented, with many modern shortcuts.
- 4Collections, generics and LINQ
List<T>,Dictionary<TKey, TValue>andHashSet<T>hold most of your data. - 5Exceptions and nullable typesC# signals failure with exceptions.
- 6async/await and TasksASP.NET Core serves many requests with a small pool of threads.
- 7DNS: from a name to an addressComputers find each other by number (an IP address), but people use names like api.example.com.
- 8TCP connections and TLSOnce the client knows your server's IP address, it opens a TCP connection to a port, usually 443.
- 9HTTP requests, responses and headersHTTP is a set of structured messages sent over that connection.
- 10HTTP methods and status codesThe HTTP method says what the client wants to do.
10 in this stageOpen this stage2Relational databases and SQLAlmost every backend is a careful wrapper around a relational database. Learn to model data, write SQL by hand, index it for real queries and understand what your ORM does on your behalf.10 topics · ~3 months
- 1Queries and joinsStart by reading data from tables that already exist.
- 2Grouping and aggregatesAggregates boil many rows down to one number:
COUNT,SUM,AVG,MINandMAX. - 3Data modelling and normalisationNow design your own schema, the set of tables and how they connect.
- 4Keys, constraints and relationshipsConstraints are rules the database itself enforces.
- 5IndexesWithout an index, finding rows means reading the whole table.
- 6Reading query plans with EXPLAINEXPLAIN shows the query plan, which is how PostgreSQL intends to run your query.
- 7Transactions and ACIDA transaction groups several statements so they all succeed or all fail together.
- 8Isolation levels and lockingIsolation levels decide what transactions running at the same time can see of each other.
- 9Entity Framework Core and migrationsEntity Framework Core (EF Core) maps C# classes to database tables through a
DbContext. - 10The N+1 query problemEF Core does not load related data unless you ask for it.
10 in this stageOpen this stage- Designing and building APIsTurn your database into a service other programs can rely on. Design endpoints, status codes, pagination, idempotency, versioning and errors deliberately, and document the contract with OpenAPI.10 topics · ~3 monthsOpens with credits
- Authentication and API securityDecide who can call your API and what each caller may do, then close the holes attackers try first. Authentication, tokens and authorisation are where most real API breaches start.10 topics · ~2 monthsOpens with credits
- Caching, queues and performanceMake the service fast and keep slow work out of the request path. Learn where to cache and how to invalidate, move heavy jobs onto queues, and measure latency before and after every change.10 topics · ~2 monthsOpens with credits
- Testing, CI/CD and deploymentBuild the safety net that lets you change code without fear: tests that hit a real database, a pipeline that runs them on every push, and a container you can deploy and roll back.10 topics · ~2 monthsOpens with credits
- Architecture and reliabilityLearn how services are split, how they talk and how they fail. Apply the patterns that keep a system up when a dependency is slow or down, and make every request traceable.10 topics · ~3 monthsOpens with credits
5 more stages, 50 more topics, free with an account.
You have seen the open stages of the Backend development roadmap. Every topic it covers is listed above, and an account opens the rest: what each topic means, a question to check yourself, the courses, the practice and Tauseef's advice for every stage. Early access is open: sign up and your account is active shortly after.
Everything here is free to learn from. A few things, like adding a roadmap, keeping a cheat sheet or asking Tauseef a question, use credits. You get 15 when you join, your first roadmap is free, and if you are learning seriously and run out, you can ask for more. Credits only make sure the platform goes to people who are actually learning.
Related on Sefism
Picked from the other libraries by shared topics.
Best practices
See all- REST API Design Best PracticesDesign HTTP APIs clients enjoy using: resources and URLs, methods, status codes, problem details errors, pagination, idempotency keys, ETags, versioning and OpenAPI.
- TypeScript Best PracticesModern TypeScript best practices for 2026: strict settings, TypeScript 7, modeling data with unions, safe narrowing, runtime validation, generics and typed linting.
- Authentication Best PracticesBuild sign-in that holds up: password rules from NIST, Argon2id hashing, login throttling, MFA and passkeys, secure sessions and safe account recovery.
Checklists
See all- Production Readiness ChecklistCheck a service before it takes real traffic: ownership, SLOs, capacity, timeouts and retries, alerts, rollout and rollback, backups, security and on-call.
- API Security ChecklistCheck your REST or GraphQL API against the OWASP API Security Top 10: authentication, object authorization, rate limits, input validation, SSRF, CORS and logging.
- Database Migration ChecklistCheck a schema or data migration before it ships: expand and contract, lock behaviour, online indexes, batched backfills, rehearsal on real data, backups, rollback, deploy order and monitoring.
Project structures
See all- Express with TypeScript project structureFor students who know a bit of JavaScript and want a backend that looks like the ones teams actually run. Express gives you almost no structure, so this layout supplies it: one folder per feature under src/modules, each split into routes, controller, service and repository, with Zod at the edge and Vitest plus Supertest for tests.
- NestJS project structureFor people who want a structured TypeScript backend with clear rules about where code goes. Every feature is a Nest module that owns its controller, service, DTOs, entities and tests, so the app grows by adding folders, not by stretching old ones. The tree follows one orders API from nest new to a codebase a whole team can run for years.
- FastAPI project structureA typed Python API for an orders app, built the way the FastAPI docs and the official full stack template lay it out: one
apppackage, a router per feature, Pydantic schemas at the edges, services in the middle and SQLAlchemy models with Alembic migrations underneath. For students who have finished the FastAPI tutorial and want to know where the second, tenth and fiftieth file go.
Career questions
See all- How do I choose between frontend, backend, mobile, cloud, cybersecurity, data and AI without trying them all for years?Do not try to pick the best field; pick the one whose daily problems you can tolerate on a bad day. Run a short, cheap experiment in two or three candidates, compare what you enjoyed doing rather than what sounded exciting, check the local job market, and commit for six to nine months.
- Should I use Firebase or Supabase for my app?Both let you ship an app fast with auth, a database, storage and hosting-style services. Supabase is built on PostgreSQL, so it suits relational data and SQL skills you will reuse anywhere. Firebase is a mature Google platform with a document database and strong mobile tooling. Choose by your data shape, your platform, and how much you want to learn transferable database skills.
- What should I learn to become a web developer, and in what order?Learn the web platform first (HTML, CSS, JavaScript, how HTTP works), then one frontend framework, then a backend with a database, and build a real project at each stage. If you already know WordPress, you are not starting over: your HTML, CSS and PHP experience transfers.
Cheat sheets
See allWork with me
Stuck on something specific?
Writing only gets you so far. If you want an answer to your situation rather than the general case, book a session and we will work through it together. Sessions are free for approved Sefism members, and a few slots open each week.
- 1:1 Mentorship
- Fresh Graduate Mentorship
- Career Guidance
Brand deals, promos and partnerships: tauseeffayyaz@gmail.com