Intermediate concepts in Backend Dev, page 13
Sinon.JS: Isolate and Inspect Code for Unit Tests
Sinon.JS lets you replace real functions with test doubles to check *if* and *how* they were called. Use it to fake network requests or control timers. The biggest footgun is forgetting to restore fakes, which causes tests to leak state and fail unpredictably.
Heap Snapshots: Finding Node.js Memory Leaks
A heap snapshot is a photograph of your app's memory. Use it to diagnose leaks by comparing snapshots over time to see which objects grow. The big footgun: taking one freezes your app and can double memory usage, risking a crash in production.
Go's Worker Pool Pattern: Capping Concurrency
A worker pool caps concurrency by using a fixed number of goroutines to process jobs from a queue. Use it for rate-limiting API calls or processing files without spawning unlimited goroutines.
Production Secret Management: Inject, Don't Store
Treat secrets like temporary credentials, injected at runtime, not stored with your code. This applies to database passwords and API keys in production. The biggest footgun is using .env files; they are a dev convenience, not a security model.
Go's Functional Options Pattern for Flexible APIs
The functional options pattern uses functions to set optional struct fields, making APIs flexible and readable. It's common for complex constructors like servers or DB clients.
Callback Hell: The Pyramid of Doom
Callback hell is what happens when nested async callbacks indent so deeply the code forms an unreadable pyramid. You see it in legacy Node.js when chaining database queries or file reads.
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
MongoDB Aggregation Pipeline: Server-Side Assembly Line
MongoDB's aggregation pipeline reshapes documents stage by stage on the server. Use it for reports, joins, or analytics without pulling whole collections into your app. Running $sort or $group before $match scans excess documents and kills performance.
Rust's Deref Trait: Smart Pointers Acting Like Data
The Deref trait lets a "smart pointer" type act like the data it contains, making wrappers transparent. It enables calling an inner type's methods directly on a wrapper, like using &str methods on a String. Its deref() method must never fail.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
Terminal User Interfaces (TUIs): GUIs for the Console
A TUI is a graphical interface built from text, offering rich interactivity without leaving the console. Use them for system monitoring (btop), file management, or database clients. The footgun: don't confuse them with CLIs; TUIs are stateful apps.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Operational vs Programmer Errors in Node
Operational errors are expected problems like a failed network request; programmer errors are bugs like reading undefined. Handle the first gracefully, crash the second. The footgun is catching programmer errors and continuing, which corrupts process state.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Rust Lifetimes: Preventing Dangling References
Lifetimes are Rust's compile-time guarantee that a reference never outlives the data it points to. The borrow checker uses them to prevent dangling pointers, a common source of bugs.
Rust's Fearless Concurrency: Catch Bugs Before They Ship
Rust's "fearless concurrency" uses the ownership and type system to turn data races into compile-time errors. This allows you to safely use threads, message passing, or shared state without runtime surprises. The footgun is assuming this prevents all bugs.
Rust Enums and Pattern Matching: Type-Safe Alternatives
Rust enums define a type that can be one of several variants, each holding its own data. They're used to model states like Loading/Success/Error or handle optional values with Option<T>.
Rust's TcpStream: Your Handle to a Network Connection
A TcpStream is Rust's handle to a network connection, closing automatically when it goes out of scope. Use it to talk to servers. The footgun: connect() can block forever; always prefer connect_timeout() in production to avoid hanging.
Rust's Serde: Taming JSON with Types
Serde JSON translates between human-readable JSON text and native Rust structs, acting as a bilingual interpreter for your data. Use it for web APIs or config files.
The Newtype Pattern: Type Safety for Primitives
Wrap a primitive type in a new struct to give it a unique, compile-time identity. A Miles(f64) is different from a Kilometers(f64). Use it to prevent mixing up IDs or units. The footgun: you must explicitly implement or delegate methods for the new type.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles