How {{brand}} is built

A course for developers: the technologies {{brand}} is built with, the options each choice was made between and why - lesson by lesson, in the order the product was built.

• The map: every technology and where it sits - Every technology in {{brand}} on one map: the six layers a request passes through, what each technology does and why it was chosen, one request traced end to end, the seam rule that keeps the parts apart, and how to read the rest of the course.
• Architecture: the modular monolith - Layered monolith, modular monolith, microservices or serverless - how each is built, which one {{brand}} chose and why, and the techniques that make it work: modules with a schema each, a shared kernel with seams, dependency injection and its lifetimes, vertical slices, CQRS with a small mediator, module switches, architecture tests and the path to move a module out later.
• .NET and ASP.NET Core: the path of one request - How the .NET runtime and the ASP.NET Core host start, where settings and secrets come from, why middleware order decides safety, how Minimal APIs route and bind a request with code generated at build time, how a mediator hands it to one handler, and how errors, rate limits, CORS and CSRF are handled - step by step, with pictures.
• Data: PostgreSQL and EF Core - storing, guarding and forgetting records - How PostgreSQL works inside (schemas, indexes, MVCC and xmin, isolation levels, advisory locks, full-text search, JSON), how EF Core works (DbContext, change tracking, filters, interceptors, migrations, ExecuteUpdate, retries), and the techniques built on them: soft delete, tenant isolation, race-safe writes, expand-and-contract migrations, GDPR erasure and the Data Protection key ring.
• Authentication: sessions, JWT, two-step and passkeys - How a server proves who is calling: authentication versus authorization, how a JWT is built, signed and checked, where a browser keeps a session and how it survives XSS and CSRF, how a session is ended early, how passwords are stored and guessing is stopped, and how authenticator codes and passkeys work inside - step by step, with what {{brand}} chose and why.
• Single sign-on: OAuth 2.0, OpenID Connect, SAML and SCIM - What OAuth 2.0, OpenID Connect, SAML and SCIM each do, how discovery documents and signing keys work, the authorization-code flow with PKCE, state and nonce, every check an ID token must pass, why people are matched by subject id, how a DNS TXT record proves a domain, and how to require single sign-on without locking anyone out.
• Authorization: roles, grants, plans and API tokens - How a multi-tenant product decides what each caller may do: RBAC, ABAC, ReBAC and per-record grants, the order a policy is evaluated in, tenant checks, why some refusals are 404, plans and limits as data, quotas charged without races, and API tokens and service accounts behind deny-by-default routes - with pictures and examples.
• Real time, events and background work: SignalR, the outbox and hosted services - How a server speaks first (polling, server-sent events, WebSockets and SignalR), how modules hear each other's facts without losing one (in-process events and the transactional outbox), and how work runs by itself - hosted services, distributed leases, caching and signed webhooks - step by step, with pictures.
• Files, email and push notifications - storing, sending and fanning out - How files live in object storage behind one interface and travel as streams, how signed links and virus scanning work, how an email travels with SMTP and MIME and reaches the inbox (SPF, DKIM, DMARC, one-click unsubscribe), how Web Push with VAPID and a service worker reaches a phone, and how one event fans out to many people while storing them only as ids.
• Search, reports and document generation - from an inverted index to a PDF - How full-text search works inside - the inverted index, stemming and scoring - where a search should run, and how reports are built once, kept as snapshots, sent on a schedule and written as Excel and PDF files without giving away small groups.
• AI: LLMs, providers, the platform's AI and your own - How a language model reads and writes tokens and what each call costs, how the provider APIs differ and how one catalog hides them, how the platform's AI and your own key share the work and in what order, and how cost, caching, streaming and structured output are done safely - step by step, with pictures.
• AI: RAG and chunking - how the assistant finds what to read - What RAG is, why text must be cut into chunks, the main ways to cut it with a worked example of each, how pieces are scored, and how {{brand}} applies them - step by step, with pictures.
• AI: grounding, prompt injection and fairness - Why language models invent answers and obey planted text, the layered defences that stop both - grounding with citations, fences with a one-time nonce, no tools, checked output and a person who confirms - how to red-team an AI feature, how fairness is measured when AI touches people, and the OWASP Top 10 for LLM applications mapped to defences.
• AI agents and the Model Context Protocol (MCP) - What an AI agent is - tool calling, planning, the loop and its guardrails - and the Model Context Protocol from hosts and servers down to the JSON-RPC messages, with real example messages, how to write and connect a server, and the two agent patterns {{brand}} uses.
• HTTP, REST and API testing technology - How HTTP really works - methods, status codes, headers, cookies, redirects and TLS - then REST and OpenAPI, the .NET HttpClient stack, how a test engine fills variables and judges JSONPath and JSON Schema checks, how to stop SSRF, mock servers, load-testing math, breaking-change detection and API tests in CI.
• Browser automation: Playwright and browser extensions - How a program drives a real browser through WebDriver and the DevTools Protocol, how Playwright is built and why it waits for you, how to find elements by role and accessible name, how to stop flaky tests, how a Manifest V3 extension records clicks, and how to keep a test browser away from private networks.
• Database drivers, ADO.NET and Redis - talking to databases and caches safely - How .NET talks to a database through ADO.NET - pooled connections, commands, parameters, readers and transactions - why parameters stop SQL injection, how one driver contract covers PostgreSQL, SQL Server and SQLite, how Redis stores, expires and evicts data, why SCAN beats KEYS, what a multiplexer is, and how to run a query you did not write without letting it change anything.
• Real-time collaboration techniques: ordering, sync and large lists - The engineering behind screens many people change at once: ordering with sparse positions instead of re-numbering, optimistic updates that roll back, row versions, leases and three-way merges for conflicts, granular sync compared with full reloads and CRDTs, virtualized lists, roll-ups over trees and history from soft-deleted rows - step by step, with worked examples.
• Diagrams and code analysis: drawing designs and reading repositories - How a diagram editor stores, draws, lays out and exports a graph; how to read GitHub, GitLab and Azure DevOps repositories through their APIs with read-only tokens, ETags and rate limits; how manifests become a service map without running anything; and how drift and threat rules run on a graph - step by step, with examples.
• Secure links, calendar files and privacy engineering - How a link can safely stand in for an account - random tokens, purpose binding, expiry, hashing and revocation - how magic links work and where they fail, how an iCalendar invitation is written so an update replaces it and a cancellation removes it, and the privacy-engineering techniques behind it all: data minimization, retention and scheduled erasure, anonymization versus deletion, personal-data markers, an audit trail without values, and fairness filters for AI text about people.
• Frontend: React, TypeScript, Vite and TanStack Query - How a modern single-page app is built: React 19 components, hooks and rendering, what strict TypeScript catches, how Vite and Rolldown bundle and split the code, why server data lives in TanStack Query and not Redux, a layered structure a script enforces, bundle budgets, service workers, accessibility with ARIA and axe, theming with design tokens and the SignalR client - step by step, with pictures.
• Internationalization: one product in several languages - How one product speaks English, Russian and Azerbaijani: i18n versus l10n, i18next with namespaces, typed keys and CLDR plurals, Intl formatting and its Azerbaijani gap, localized .NET errors and stored sentences, and a translation pipeline with memory, glossaries, validation, machine translation, human review and a CI gate.
• Testing: integration tests, Testcontainers and Playwright - How a web product is tested from the inside out: the test pyramid and the testing trophy, xUnit, integration tests with WebApplicationFactory and fakes, in-memory databases against a real PostgreSQL in Testcontainers, architecture and approval tests, Vitest, browser walks with Playwright and axe, flaky tests, test data and CI - and the choices {{brand}} made.
• Payments: merchants of record, webhooks and subscriptions - Who really sells when a customer pays - a merchant of record or you - how hosted checkout keeps card data out of the app, how to trust a webhook with HMAC signatures, timestamps, idempotency, event ordering and optimistic concurrency, how a subscription moves through trial, active, past due, canceled and refunded, why entitlements are data, and how to test all of it with a stand-in provider.
• Self-hosted software: editions, licensing and installs - How one codebase ships both as a hosted service and as software a company runs itself: SaaS, self-hosted and bring-your-own-database compared, the edition decided at build time, offline licences as ES256-signed JWTs with activation by file exchange, Docker Compose and Helm packaging, air-gapped installs with signed images and SBOMs, key management and backups, and why nothing calls home.
• Azure and DevOps: from a commit to production - How a change travels from a commit to production safely: CI and CD, Azure DevOps pipelines, supply-chain scans and SBOMs, Docker images, Azure building blocks, Cloudflare tunnels, releases with migrations first and automatic rollback, backups and OpenTelemetry - with pictures, generic code and interview answers.