Performance & security
Investigate production incidents and protect application boundaries.
API latency jumps from 200ms to 5s. What do I do?
A jump from 200ms to 5s indicates that requests are doing more work, waiting longer, or both. The first task is to establish scope and timing so the incident is not mistaken for one user's network issue. Then use measured stages to separate a recent regression from traffic or dependency saturation.
PostgreSQL CPU becomes very high. What do I check?
High PostgreSQL CPU means the database is spending substantial time processing work rather than simply waiting for requests. Causes include expensive queries, poor plans, repeated query volume or maintenance work. CPU alone does not tell you whether an index, query rewrite or traffic reduction is the right fix.
MongoDB aggregation becomes slow. What do I check?
A slow aggregation often processes a much larger intermediate dataset than its final output suggests. Joins, unwinds, sorts and groups can expand work or exceed useful memory limits. Inspecting the pipeline stage by stage reveals where the expensive growth occurs.
Node memory keeps growing. How do I investigate?
Growing Node memory can be normal temporary allocation, retained JavaScript objects, native buffers or another process-level resource. A leak is suggested when unnecessary retained memory continues to grow across comparable workloads and garbage-collection cycles. Heap size and total process memory are related but not identical measurements.
The event loop is blocked. What do I do?
An event-loop block happens when synchronous JavaScript occupies the thread long enough to delay other callbacks. Requests can appear to hang even when their own logic is simple because they share that scheduling thread. Measuring loop delay and CPU profiles connects the symptom to a specific workload.
The database connection pool is exhausted. What do I do?
A connection pool has a limited number of database connections and queues callers when all are busy. Exhaustion can come from too much parallel work, slow queries, long transactions or connections that are never released. Increasing the limit may overload the database instead of fixing the cause.
Authentication tokens are being abused. What do I do?
Abused credentials create an active access-control incident, not just a validation bug. The response must stop unauthorized use, establish how credentials were obtained and restore the affected authentication boundary. The right revocation action depends on whether a single session, many refresh tokens or signing credentials were compromised.
A third-party API starts timing out. What do I do?
A third-party timeout means your service did not receive an answer within its waiting budget. It does not prove that the remote operation was never performed. Timeouts need bounded waiting, controlled concurrency and a strategy for uncertain results, especially for actions with side effects.
Duplicate workflow jobs are processed. How do I fix this?
Duplicate jobs can occur when a producer resends work or a consumer crashes before acknowledging a completed action. Many reliable delivery systems intentionally allow redelivery to avoid losing work. Correct processing therefore identifies the logical operation and makes repeated attempts safe.
A deployment causes intermittent 500s. What do I check?
Intermittent failures after deployment often mean only some instances, requests or data shapes are incompatible with the change. A rolling deployment can briefly run old and new versions together. Grouping errors by instance and version reveals whether the issue is configuration, code, readiness or schema compatibility.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.