Software Engineering Standards

The Software Engineering Standards Hub.

The definitive resource for the standards that power world-class
software engineering organizations.

Three tall purple rectangular blocks standing side by side on a purple background.

About the Hub

What you’ll find

In-depth guides to software engineering standards, from architecture and APIs to databases, reliability, testing, and security. Each guide explains the standard, the reasoning behind it, and how it applies in real engineering organizations.

How it’s organized

Standards are organized by engineering category, including Architecture, Security, Reliability, and Observability, and by topics that span those categories. Browse by domain or explore a specific technology, practice, or concern.

How to use it

Use the hub as a reference for what world-class software engineering looks like in practice. Evaluate your own standards, challenge existing approaches, align teams around proven practices, and identify where your organization can raise the bar.

BROWSE BY CATEGORY >

Architecture

Code Quality

Data & Storage

Observability

Performance

Reliability

Security

BROWSE BY TOPIC >

API Design

Cloud Platforms

Compliance & Regulation

Event Driven

Infrastructure-as-Code

Languages

Reliability ·

Retry and Timeout Best Practices

Most teams get every individual retry policy right and still amplify a 30-second degradation into a 40-minute incident. Retries compose multiplicatively across layers, and no single code review ever sees the product.

Updated Sep 2026

Security · Compliance & Regulation

Multi-Tenant and Data Isolation

Multi-tenant data isolation is the set of guarantees that keep one tenant's data from being read, written, or inferred by another tenant sharing the same application and infrastructure. This guide is about the five or six places tenant context has to travel that nobody wrote a filter for, because nobody framed them as the same problem.

Updated Sep 2026

Security · Compliance & Regulation

PII Leak Prevention

Every team that locks down its logging still watches PII resurface in error reports, traces, and query logs six months later. This guide is about why closing one observability surface doesn't close the others, and what has to change about how the rules get enforced, not just written.

Updated Sep 2026

Architecture · API Design

API Design Best Practices

Every field a client can read, every error message they can see, and every status code they get back becomes something somebody depends on. This guide covers the discipline that keeps your public contract close to what you actually ship, not just what you meant to.

Updated Sep 2026

Data & Storage · Event Driven

Data Pipeline Checkpointing and Failure Recovery

Checkpointing looks like a performance feature: a way to avoid reprocessing records you've already handled. It's actually a correctness contract between two separate writes, and the order you perform them in decides whether a restart costs you a few duplicate rows or a silent, undetected gap in your data.

Updated Sep 2026

Performance ·

Database Query Performance & Indexing

Most database performance incidents get diagnosed as an indexing problem and closed with an index. This guide is about the other 80% - the query shape, round-trip count, and containment decisions that no index can fix - and where each one actually breaks in a growing codebase.

Updated Sep 2026

Code Quality ·

Error Handling and Exception Discipline

Every catch block in this codebase looks reasonable in its own diff. That's exactly the problem. This guide is about why exception handling fails as a routing problem, not a resilience one, and what has to change about how the routing gets enforced, not just written.

Updated Sep 2026

Observability ·

Structured Logging Standards & Log Hygiene

Structured logging standards are the rules governing how a service emits, labels, and protects its log output. This guide is about why those rules keep getting broken by engineers who already agree with them, at the exact moment the rules exist to protect.

Updated Sep 2026

Architecture · Event Driven

Microservice Boundary Discipline

Every team that draws clean service boundaries on a whiteboard still watches them dissolve in production. This guide is about why that keeps happening even to teams who already know the theory, and what has to change about how the rules get enforced, not just written.

Updated Sep 2026

Observability · Cloud Platforms

SLO-Based Alerting and Metrics Instrumentation

A green dashboard and a working product are not the same claim, and most alerting setups quietly conflate them. This guide sets out seven principles for metrics instrumentation and SLO-based alerting that keep the two connected, so an alert firing actually means a user is about to feel something.

Updated Sep 2026

Data & Storage ·

Caching Correctness

The famous joke says cache invalidation is one of the two hard problems in computer science. It is not. The hard problem is key design, and invalidation only becomes intractable when the key failed to encode something the cached value depended on.

Updated Sep 2026

Security · API Design

Authorization Best Practices

Access control does not usually fail because someone forgot to write a check. It fails because the check was written somewhere a reviewer can pass without it, and because nothing in the codebase distinguishes an endpoint that was deliberately left open from one that nobody thought about.

Updated Sep 2026

Reliability · Event Driven

Idempotency for Event-Driven Applications

Every message broker you can buy delivers at least once. That is not a limitation you can configure away, and the teams that treat it as one end up with double charges, duplicated ledger entries, and a postmortem that blames the queue. Idempotency is the discipline of making the second delivery a no-op.

Updated Sep 2026

Data & Storage · Languages

Database Transaction Safety

Every transaction bug you have shipped was a scope bug before it was an isolation bug. The boundary got drawn around a service method instead of around the set of writes that must land together, and no isolation level fixes a span that is the wrong shape.

Updated Sep 2026

Architecture ·

Legacy Code Modernization

Legacy code modernization is usually planned as a risk problem: how do we avoid breaking production during the cutover. The cutover is rarely what breaks. What breaks is the year after it, when the old path is still running, the new path is still guarded by a flag nobody remembers, and both are now load-bearing.

Updated Sep 2026

Architecture · Infrastructure-as-Code

Twelve-Factor Configuration

Twelve-factor configuration is usually taught as a rule about environment variables. The rule that actually prevents incidents is narrower: no application code should be able to name the environment it is running in. This guide covers the seven checks that hold that line, and what happens when one service in the estate quietly stops holding it.

Updated Sep 2026

Reliability ·

Race Condition and Deadlock Prevention

Most race conditions and deadlocks trace back to a single unresolved question: who owns this piece of state at the moment two things touch it. This guide sets out seven decision rules for shared state, locking, and asynchronous execution that make that ownership explicit instead of implicit and undiscovered.

Updated Sep 2026

Security ·

Prompt Injection Prevention

Most teams invest in the assumption they can stop a model's instructions from being overridden by content it reads. The teams that stay out of the incident report invest in making that override not matter.

Updated Sep 2026

Security · Infrastructure-as-Code

Secrets Management Best Practices

Most organizations adopt a vault, declare the problem solved, then discover during an incident that the credential they need to revoke exists in nine other places - a CI variable, a state file, an image layer, a Slack thread from 2023.

Updated Sep 2026

Observability ·

Distributed Tracing Best Practices

Most organizations have tracing deployed and still cannot answer the question they bought it for. A trace that loses its context at hop four is not a partial trace - it is two unrelated traces, and neither one contains the answer.

Updated Sep 2026