SEARCH
PART 11 · BUILD SOFTWARE
PART 11
BUILD SOFTWARE
9 classes. Each class holds its own standalone lessons.
PART 11 CLASSES
CLASSES, THEN LESSONS.
CLASS 45Front End vs Back End
One User Action, Five System Responsibilities
Trace one user action from a browser through trusted rules and data, then back to a useful screen.
READ LESSON →September 12, 2026 · CLASS 45Front End: Make a User's Job Clear, Not Just a Screen Attractive
Build user flows with accessible normal, loading, empty, error, keyboard, and mobile states.
READ LESSON →September 12, 2026 · CLASS 45Backend: The Trusted Place Where Product Rules Actually Run
Define the trusted rules, validation, secrets, and safe error behavior behind one application route.
READ LESSON →CLASS 46Application Architecture
Start With a Simple Architecture You Can Explain on One Page
Choose the smallest sensible first architecture instead of letting AI multiply services without a reason.
READ LESSON →September 12, 2026 · CLASS 46Boundaries and Contracts: Where Systems Agree to Meet
Use clear API, data, provider, and worker contracts to keep independently built pieces compatible.
READ LESSON →September 12, 2026 · CLASS 46Architecture Decisions Have Tradeoffs, Not Perfect Winners
Record a deliberate architecture choice, its tradeoffs, and the evidence that would justify revisiting it.
READ LESSON →CLASS 47Authentication and User Accounts
Identity Is Not Permission
Separate proving who someone is from deciding what they may do to a specific record or system.
READ LESSON →September 12, 2026 · CLASS 47Sign-In, Sessions, Passwordless, and OAuth Without the Mystique
Understand the secure sign-in lifecycle and why trusted identity providers are the right default.
READ LESSON →September 12, 2026 · CLASS 47Roles, Ownership, and Safe Account Features
Model roles, ownership, and narrow service access without confusing a hidden button for a security boundary.
READ LESSON →CLASS 48Security for AI Builders
Security Begins With “What Could Go Wrong?”
Create a practical threat model before a feature makes sensitive data, access, or spending real.
READ LESSON →September 12, 2026 · CLASS 48Inputs, Secrets, and the Boundary Between Helpful and Unsafe
Validate all untrusted input and keep secrets out of browsers, repositories, prompts, and logs.
READ LESSON →September 12, 2026 · CLASS 48Access Control, Rate Limits, and Safe Failure
Combine policy checks, limits, idempotency, and useful non-sensitive failures on an important route.
READ LESSON →September 12, 2026 · CLASS 48Dependencies, Configuration, and the AI Security Review
Review packages, deployment configuration, and generated code with AI as a careful extra reviewer.
READ LESSON →CLASS 49Penetration Testing and Independent Security Review
What a Pentest Is — and What It Is Not
Know when an independent, authorized penetration test is justified and how to prepare a safe scope.
READ LESSON →September 12, 2026 · CLASS 49Prepare, Receive Findings, Fix, and Prove the Fix
Turn a security finding into a focused repair, regression check, verified retest, and durable record.
READ LESSON →CLASS 50Testing
A Test Is a Claim With Evidence
Choose the smallest useful test that proves an expected behavior and exposes a regression.
READ LESSON →September 12, 2026 · CLASS 50Unit and Component Tests: Check Small Rules Without Pretending They Are the Whole App
Test focused rules and interface behavior with meaningful assertions instead of brittle test volume.
READ LESSON →September 12, 2026 · CLASS 50Integration and Browser Tests: Check the Seams Users Actually Cross
Prove the API, identity, data, and browser journey work together without ever pointing destructive tests at production.
READ LESSON →September 12, 2026 · CLASS 50AI Can Write Tests; You Still Decide What Must Be Proven
Use AI to write tests while retaining human ownership of the risks, behavior, and independent review.
READ LESSON →CLASS 51Logs, Errors, and Observability
Every Failure Needs a Trail You Can Follow
Turn “it does not work” into an evidence trail from a user action through the correct system layers.
READ LESSON →September 12, 2026 · CLASS 51Read the Right Layer Before You Ask AI to Fix Anything
Locate a failure in the browser, server, database, deployment, or provider before proposing a patch.
READ LESSON →September 12, 2026 · CLASS 51Healthy Is More Than the Homepage Loaded Once
Use signals, alerts, and ownership to tell the difference between a live application and a healthy one.
READ LESSON →CLASS 52Debugging With AI
Reproduce Before You Explain
Create a reproduction another person can repeat before AI starts changing code around a bug.
READ LESSON →September 12, 2026 · CLASS 52Ask AI to Investigate, Not to Spray Patches
Require evidence, ranked hypotheses, and a no-edit investigation phase before authorizing a fix.
READ LESSON →September 12, 2026 · CLASS 52Fix the Cause, Prove the Behavior, Leave a Better System
Repair a cause, add the regression proof, improve the evidence trail, and leave a trusted handoff.
READ LESSON →CLASS 53Refactoring and Code Cleanup
Technical Debt Is a Change-Cost Problem
Recognize technical debt through the change cost and risk it creates—not simply personal taste in code.
READ LESSON →September 12, 2026 · CLASS 53Refactor One Safe Seam at a Time
Improve one bounded internal seam while preserving observable behavior and keeping review possible.
READ LESSON →September 12, 2026 · CLASS 53Cleanup Is Also Dependencies, Documentation, and Ownership
Treat dependencies, configuration, credentials, docs, and ownership as part of responsible code cleanup.
READ LESSON →September 12, 2026 · CLASS 53Capstone — A Controlled Vertical Slice: Private Watchlist
Bring architecture, ownership, security, tests, logs, review, and handoff together in one complete feature.
READ LESSON →