One search. Connected ideas.

Protect application boundaries and investigate production failures.

Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.

Big-O describes how an algorithm's work or memory grows as the input grows. Profiling measures where a particular application spends time or retains memory during a real workload. They complement each other: growth rate explains future scaling, while profiling locates the current bottleneck.

API latency is the total time a request spends waiting and doing work across the system. That time can include load-balancer delay, connection-pool wait, application CPU, database work and external calls. Breaking it into stages turns “the API is slow” into a testable explanation.

Pagination, streaming, compression and CDNs reduce different costs of moving data. Pagination returns fewer records, streaming avoids buffering the full payload, compression sends fewer bytes, and a CDN shortens the route for reusable content. Choosing the right technique requires knowing whether the problem is volume, memory, bandwidth or distance.

Token and session security means accepting only credentials issued by a trusted authority for the intended purpose and lifetime. A JWT can carry verifiable claims, while a server session uses stored state behind a session identifier. Both need secure transport, controlled storage, expiry and a response to credential theft.

Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.

XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.

Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.

Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.

Rate limiting restricts how much work a caller can request within a defined policy. It protects capacity and makes repeated abuse harder, but it cannot distinguish every attacker or stop all traffic before it reaches the system. Rules should fit the resource, user identity and infrastructure layer.

Observability means understanding a system's behavior from the information it emits. Logs capture events, metrics summarize measurements over time, and traces connect work across a request path. An SLI is a measured service behavior, while an SLO is the target the team aims to meet over a defined period.

Big-O describes how an algorithm's work or memory grows as the input grows. Profiling measures where a particular application spends time or retains memory during a real workload. They complement each other: growth rate explains future scaling, while profiling locates the current bottleneck.

API latency is the total time a request spends waiting and doing work across the system. That time can include load-balancer delay, connection-pool wait, application CPU, database work and external calls. Breaking it into stages turns “the API is slow” into a testable explanation.

Pagination, streaming, compression and CDNs reduce different costs of moving data. Pagination returns fewer records, streaming avoids buffering the full payload, compression sends fewer bytes, and a CDN shortens the route for reusable content. Choosing the right technique requires knowing whether the problem is volume, memory, bandwidth or distance.

Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.

A third-party timeout means your service did not receive an answer within its waiting budget. It does not prove that the remote operation was never performed. Timeouts need bounded waiting, controlled concurrency and a strategy for uncertain results, especially for actions with side effects.

A slow aggregation often processes a much larger intermediate dataset than its final output suggests. Joins, unwinds, sorts and groups can expand work or exceed useful memory limits. Inspecting the pipeline stage by stage reveals where the expensive growth occurs.

Token and session security means accepting only credentials issued by a trusted authority for the intended purpose and lifetime. A JWT can carry verifiable claims, while a server session uses stored state behind a session identifier. Both need secure transport, controlled storage, expiry and a response to credential theft.

Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.

XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.

Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.

Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.

Rate limiting restricts how much work a caller can request within a defined policy. It protects capacity and makes repeated abuse harder, but it cannot distinguish every attacker or stop all traffic before it reaches the system. Rules should fit the resource, user identity and infrastructure layer.

Security & performance learning module

Security & performance learning module

Security & performance learning module