# backend-skills — Backend Development Skill Collection

Author: Simon-Pierre Boucher Contact: contact@spboucher.ai

Twenty ultra-sharp backend skills following the method in ../RESEARCH-SYNTHESIS.md. Database-specific work lives in ../db-skills/ — this collection deliberately excludes it. All pass python3 ../tools/validate_skills.py.

# The collection and its boundaries

API design

Skill	Handles	Explicitly does NOT handle
`designing-rest-apis`	resources, methods, status codes, pagination, versioning, problem+json, OpenAPI	GraphQL; webhooks; auth mechanics
`designing-graphql-apis`	schema design, DataLoader/N+1, cursor pagination, complexity limits	REST; subscriptions infra
`designing-webhooks`	payloads, HMAC signing, retries, idempotent delivery	consuming webhooks' business logic; internal messaging
`handling-file-uploads`	presigned URLs, validation, safe naming, streaming, resumable	serving files; image processing; CDNs

Security (defensive)

Skill	Handles	Explicitly does NOT handle
`implementing-authentication`	password storage, sessions vs JWT, OAuth2/OIDC + PKCE, MFA, resets	permissions → `implementing-authorization`; DB creds → db-skills
`implementing-authorization`	RBAC/ABAC, deny-by-default, IDOR, tenant isolation, policy centralization	login/identity → `implementing-authentication`
`validating-input`	boundary schemas, allowlists, canonicalization, 422 responses	authn/authz; deep business rules
`securing-backend-services`	headers, TLS, dependencies, secrets, SSRF/CSRF, least privilege	login, permissions, input validation, DB security (see above)

Reliability & operations

Skill	Handles	Explicitly does NOT handle
`handling-errors`	error taxonomy, problem+json mapping, retries, circuit breakers	validation responses; observability pipelines
`instrumenting-observability`	structured logs, correlation IDs, RED metrics, OpenTelemetry, alerting	error-handling code; incident process
`testing-backend-services`	test pyramid, testcontainers, contract tests, determinism	UI testing; load testing
`managing-configuration`	12-factor env config, startup validation, secrets separation	infra provisioning; CI/CD config

Async & performance

Skill	Handles	Explicitly does NOT handle
`writing-background-jobs`	idempotent jobs, retries/backoff, DLQ, timeouts	inter-service messaging; system cron
`handling-async-messaging`	outbox pattern, event versioning, ordering, poison messages	in-process job queues; customer webhooks
`caching-strategies`	cache-aside, TTL discipline, invalidation, stampede protection	CDN/edge config; SQL tuning → db-skills
`limiting-request-rates`	token bucket, 429/Retry-After, tiered limits, load shedding	authorization; capacity planning

Infrastructure & architecture

Skill	Handles	Explicitly does NOT handle
`containerizing-services`	multi-stage builds, non-root, layer caching, health checks	Kubernetes; pipeline design
`shipping-with-ci-cd`	stages, build-once-promote, deploy strategies, rollback	writing tests; Dockerfiles
`architecting-service-boundaries`	modular monolith default, data ownership, sagas, strangler	messaging mechanics; endpoint design
`scaling-backend-services`	statelessness, pooling, load balancing, autoscaling, replicas	query tuning; caching; rate limiting

# Shared conventions

Description = WHAT + "Use when …" (literal phrases) + "Do not use for …"
One default per decision with an escape hatch; concrete values over adjectives
Every workflow ends with a validation step (replay a job twice, boot with a missing var, kill an instance mid-deploy)
SKILL.md <150 lines; depth in references/patterns.md (with TOC)