Learn

Tracks that go in order

Not a blog archive you have to reverse-engineer. Each track builds in sequence, every lesson opens with what you will be able to do afterwards, and every lesson ends with something to actually try.

3 tracks · 12 lessons · ~2 hoursOr browse 20 short tips
Intermediate

Next.js in Production

The App Router, explained by what it does at runtime.

4 lessons · 38 minStart
Advanced

Auth That Holds Up

Sessions, cookies, tokens — and the defaults that quietly leak.

4 lessons · 38 minStart

How this works

Written to be worked through, not skimmed

The format is the same every time, so you always know where you are.

01

Outcomes first

Each lesson opens with what you will be able to do. If you can already do all of it, skip the lesson — that is a feature.

02

Real code, not pseudocode

Every snippet is something you could paste into a project. Where a snippet is dangerous in production, it says so directly.

03

The failure case

Most lessons show the broken version before the fixed one, because recognising a bug beats memorising a rule.

04

An exercise that bites

The exercise is usually "do this to your own codebase". Several are designed to find a real bug in something you already shipped.

Every lesson

The full index

All lessons across all tracks, in order.

  1. Next.js in ProductionWhere your code actually runsIntermediate · 9 min
  2. Next.js in ProductionThe four caches, and which one is lying to youAdvanced · 11 min
  3. Next.js in ProductionMutations without an API layerIntermediate · 10 min
  4. Next.js in ProductionThe parts that only hurt after deployIntermediate · 8 min
  5. Postgres for App DevelopersHow indexes actually workIntermediate · 12 min
  6. Postgres for App DevelopersThe N+1 problemBeginner · 9 min
  7. Postgres for App DevelopersTransactions and the lost updateAdvanced · 11 min
  8. Postgres for App DevelopersMigrations that do not take the site downAdvanced · 10 min
  9. Auth That Holds UpStoring passwordsBeginner · 8 min
  10. Auth That Holds UpSessions or JWTsIntermediate · 10 min
  11. Auth That Holds UpCookies, SameSite, and CSRFIntermediate · 9 min
  12. Auth That Holds UpOAuth without the mysticismAdvanced · 11 min
3Tracks
12Lessons
118mReading time
20TipsShorter, in /tips