Wrap-up and resources

Key Takeaways

• 1. Performance: measure before you optimise: Do not optimise what you have not measured. Look at p95, not the average, and check first for N+1 and missing indexes, the two most common causes of slowness.
• 2. Application security: Trust no input, check permissions on the server for every request, store passwords with a slow salted hash, and keep your dependencies updated.
• 3. Continuous integration and delivery (CI/CD): A machine runs the same checks on every change, and the main branch accepts only what passed. Deploying becomes a boring button, not a scary event.
• 4. Observability: logs, metrics and traces: Structured logs with a request id, four metrics (latency, traffic, errors, saturation), and alerts on what users feel, not on everything.

Glossary