Track 4 of 4 · 7 short steps
Building for Scale
Goal: Move from a single-file script to real, multi-user production applications.
Why this matters
This is where vibe-coded apps most often get into trouble: data that leaks between users, pages that slow to a crawl, and logins that aren't as secure as they look. Systems knowledge is what turns a demo into a product people can trust with their data.
The steps
Each step is a 2-minute read with a quick check at the end.
- Step 1
How the web talks: HTTP, TCP/IP, WebSockets
- Step 2
APIs: REST and GraphQL
- Step 3
Databases: SQL vs. NoSQL, schemas and normalization
- Step 4
Indexes and ACID transactions
- Step 5
Caching and queues
- Step 6
Authentication and authorization
- Step 7
System design: scaling, load balancing, monolith vs. microservices
Try it
Challenge: Spot the bug
Click the line with the bug.
Line 3 fetches any invoice by id without checking it belongs to req.user. Any logged-in user can read anyone's invoice.
AI mistakes to watch for
- Authorization checks only in the frontend; the API or database returns anything to anyone.
- Database tables exposed to the public key with Row Level Security turned off or set to
truefor everyone. - SQL built by gluing strings together with user input (SQL injection).
- No indexes on columns you filter or join by, e.g.
user_id. - Several related writes with no transaction, leaving half-finished data on failure.
- Secrets (API keys, service-role keys) shipped to the browser in frontend code.
Tip: paste a file into your AI tool and ask, "Check this for each of these issues and explain any you find." Then verify what it says yourself.
Milestone checklist
Your ticks are saved in this browser only.
Reading & free resources
- Designing Data-Intensive Applications (Martin Kleppmann)Core book. The best explanation of how data systems really work.
- MDN: HTTPMethods, status codes, headers, cookies, CORS.
- PostgreSQL documentationThe source of truth for the database most modern stacks use.
- Use The Index, Luke (free)SQL indexing and performance, explained for developers.
- The System Design PrimerFree, community-maintained guide to designing large systems.
- OWASP Top 10The most common web security risks.