Performance & security
Investigate production incidents and protect application boundaries.
What do Big-O and profiling tell me?
Big-O describes how an algorithm's work or memory grows as the input grows. Profiling measures where a particular application spends time or retains memory during a real workload. They complement each other: growth rate explains future scaling, while profiling locates the current bottleneck.
How do I identify the slow part of an API?
API latency is the total time a request spends waiting and doing work across the system. That time can include load-balancer delay, connection-pool wait, application CPU, database work and external calls. Breaking it into stages turns “the API is slow” into a testable explanation.
When should I use pagination, streaming, compression or a CDN?
Pagination, streaming, compression and CDNs reduce different costs of moving data. Pagination returns fewer records, streaming avoids buffering the full payload, compression sends fewer bytes, and a CDN shortens the route for reusable content. Choosing the right technique requires knowing whether the problem is volume, memory, bandwidth or distance.
Authentication vs authorization vs RBAC?
Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.
What makes JWT or session authentication safe?
Token and session security means accepting only credentials issued by a trusted authority for the intended purpose and lifetime. A JWT can carry verifiable claims, while a server session uses stored state behind a session identifier. Both need secure transport, controlled storage, expiry and a response to credential theft.
How should I store passwords and secrets?
Password hashing turns a password into a one-way verification value using an intentionally expensive algorithm. Secret management protects credentials that the application must be able to use again, such as database passwords or API keys. Passwords should not be reversibly encrypted just so they can be compared at login.
XSS vs CSRF vs CORS?
XSS, CSRF and CORS concern browser trust but refer to different mechanisms. XSS runs attacker-controlled script in a trusted page, CSRF triggers requests with automatically attached credentials, and CORS controls whether browser code may read cross-origin responses. A defense for one does not automatically solve the others.
How do I prevent SQL injection, NoSQL injection and SSRF?
Injection occurs when untrusted data becomes part of a command's structure rather than remaining data. SSRF occurs when the server's network access is used to reach an unintended destination. These attacks bypass simple “is this input present?” checks because apparently valid strings or objects can still cause unauthorized behavior.
What are least privilege, TLS and secure headers?
Least privilege limits what a user or service can access, TLS protects data while it travels, and secure headers constrain some browser behaviors. Encryption at rest protects stored data under the storage threat model, but does not prevent an authorized application from exposing it. Security works through several focused controls rather than one universal setting.
Is rate limiting enough to prevent every attack?
Rate limiting restricts how much work a caller can request within a defined policy. It protects capacity and makes repeated abuse harder, but it cannot distinguish every attacker or stop all traffic before it reaches the system. Rules should fit the resource, user identity and infrastructure layer.
Logs vs metrics vs traces, and SLI vs SLO?
Observability means understanding a system's behavior from the information it emits. Logs capture events, metrics summarize measurements over time, and traces connect work across a request path. An SLI is a measured service behavior, while an SLO is the target the team aims to meet over a defined period.
API latency jumps from 200ms to 5s. What do I do?
A jump from 200ms to 5s indicates that requests are doing more work, waiting longer, or both. The first task is to establish scope and timing so the incident is not mistaken for one user's network issue. Then use measured stages to separate a recent regression from traffic or dependency saturation.
PostgreSQL CPU becomes very high. What do I check?
High PostgreSQL CPU means the database is spending substantial time processing work rather than simply waiting for requests. Causes include expensive queries, poor plans, repeated query volume or maintenance work. CPU alone does not tell you whether an index, query rewrite or traffic reduction is the right fix.
MongoDB aggregation becomes slow. What do I check?
A slow aggregation often processes a much larger intermediate dataset than its final output suggests. Joins, unwinds, sorts and groups can expand work or exceed useful memory limits. Inspecting the pipeline stage by stage reveals where the expensive growth occurs.
Node memory keeps growing. How do I investigate?
Growing Node memory can be normal temporary allocation, retained JavaScript objects, native buffers or another process-level resource. A leak is suggested when unnecessary retained memory continues to grow across comparable workloads and garbage-collection cycles. Heap size and total process memory are related but not identical measurements.
The event loop is blocked. What do I do?
An event-loop block happens when synchronous JavaScript occupies the thread long enough to delay other callbacks. Requests can appear to hang even when their own logic is simple because they share that scheduling thread. Measuring loop delay and CPU profiles connects the symptom to a specific workload.
The database connection pool is exhausted. What do I do?
A connection pool has a limited number of database connections and queues callers when all are busy. Exhaustion can come from too much parallel work, slow queries, long transactions or connections that are never released. Increasing the limit may overload the database instead of fixing the cause.
Authentication tokens are being abused. What do I do?
Abused credentials create an active access-control incident, not just a validation bug. The response must stop unauthorized use, establish how credentials were obtained and restore the affected authentication boundary. The right revocation action depends on whether a single session, many refresh tokens or signing credentials were compromised.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.