Software Engineering Standards

The Software Engineering Standards Hub.

The definitive resource for the standards that power world-class
software engineering organizations.

Three tall purple rectangular blocks standing side by side on a purple background.
About the Hub
01

What you’ll find

In-depth guides to software engineering standards, from architecture and APIs to databases, reliability, testing, and security. Each guide explains the standard, the reasoning behind it, and how it applies in real engineering organizations.

02

How it’s organized

Standards are organized by engineering category, including Architecture, Security, Reliability, and Observability, and by topics that span those categories. Browse by domain or explore a specific technology, practice, or concern.

03

How to use it

Use the hub as a reference for what world-class software engineering looks like in practice. Evaluate your own standards, challenge existing approaches, align teams around proven practices, and identify where your organization can raise the bar.

BROWSE BY CATEGORY >
Architecture
Code Quality
Data & Storage
Observability
Performance
Reliability
Security
BROWSE BY TOPIC >
API Design
Compliance & Regulation
Event Driven
Infrastructure-as-Code
Reliability

Retry and Timeout Best Practices

Most teams get every individual retry policy right and still amplify a 30-second degradation into a 40-minute incident. Retries compose multiplicatively across layers, and no single code review ever sees the product.
Updated Aug 2026
Security

Prompt Injection Prevention

Most teams invest in the assumption they can stop a model's instructions from being overridden by content it reads. The teams that stay out of the incident report invest in making that override not matter.
Updated Aug 2026
Security

Secrets Management Best Practices

Most organizations adopt a vault, declare the problem solved, then discover during an incident that the credential they need to revoke exists in nine other places — a CI variable, a state file, an image layer, a Slack thread from 2023.
Updated Aug 2026
Observability

Distributed Tracing Best Practices

Most organizations have tracing deployed and still cannot answer the question they bought it for. A trace that loses its context at hop four is not a partial trace — it is two unrelated traces, and neither one contains the answer.
Updated Aug 2026
Security

Multi-Tenant and Data Isolation

Multi-tenant data isolation is the set of guarantees that keep one tenant's data from being read, written, or inferred by another tenant sharing the same application and infrastructure. This guide is about the five or six places tenant context has to travel that nobody wrote a filter for, because nobody framed them as the same problem.
Updated Aug 2026
Performance

Database Query Performance & Indexing

Most database performance incidents get diagnosed as an indexing problem and closed with an index. This guide is about the other 80% — the query shape, round-trip count, and containment decisions that no index can fix — and where each one actually breaks in a growing codebase.
Updated Aug 2026
Code Quality

Error Handling and Exception Discipline

Every catch block in this codebase looks reasonable in its own diff. That's exactly the problem. This guide is about why exception handling fails as a routing problem, not a resilience one, and what has to change about how the routing gets enforced, not just written.
Updated Aug 2026
Security

PII Leak Prevention

Every team that locks down its logging still watches PII resurface in error reports, traces, and query logs six months later. This guide is about why closing one observability surface doesn't close the others, and what has to change about how the rules get enforced, not just written.
Updated Aug 2026
Architecture

API Design Best Practices

Every field a client can read, every error message they can see, and every status code they get back becomes something somebody depends on. This guide covers the discipline that keeps your public contract close to what you actually ship, not just what you meant to.
Updated Aug 2026
Data & Storage

Data Pipeline Checkpointing and Failure Recovery

Checkpointing looks like a performance feature: a way to avoid reprocessing records you've already handled. It's actually a correctness contract between two separate writes, and the order you perform them in decides whether a restart costs you a few duplicate rows or a silent, undetected gap in your data.
Updated Aug 2026
Observability

Structured Logging Standards & Log Hygiene

Structured logging standards are the rules governing how a service emits, labels, and protects its log output. This guide is about why those rules keep getting broken by engineers who already agree with them, at the exact moment the rules exist to protect.
Updated Aug 2026
Architecture

Microservice Boundary Discipline

Every team that draws clean service boundaries on a whiteboard still watches them dissolve in production. This guide is about why that keeps happening even to teams who already know the theory, and what has to change about how the rules get enforced, not just written.
Updated Aug 2026
Load More