The summary.
THE BROWSER IS UNDER THE USER'S CONTROL
Anything requiring trust — authorisation, pricing, secrets, correctness — belongs on the server.
Validate in both places: the browser for convenience, the server for correctness.
THE CHECK THAT PREVENTS THE MOST DATA EXPOSURE
Verifying the signed-in user is entitled to that specific record, on every protected action.
NEVER BUILD QUERIES BY JOINING STRINGS, AND NEVER USE FLOATING POINT FOR MONEY
Index what you filter, sort and join by. Without an index the database examines every row.
Watch for queries issued inside loops — the commonest performance fault in data-driven applications.
MAKE EVERY API RESPONSE CONSISTENT, INCLUDING ERRORS
Return status codes that match what happened. Returning success for a failure breaks everything downstream.
Version the API before others depend on it.
MOVE SLOW WORK OUT OF THE REQUEST, AND MAKE IT SAFE TO RUN TWICE
Retries happen. Record what has been processed and check before acting.
Alert when a scheduled job does not run — otherwise it fails silently for months.
VERSION STATIC ASSET FILENAMES AND CACHE THEM INDEFINITELY
And never cache a failed response — it serves the failure to everyone.
