Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions backend/expressjs/architecture.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,11 @@
---
description: Vibe coding guidelines and architectural constraints for Express.js within the backend domain.
technology: Express.js
domain: backend
level: Senior/Architect
complexity: Advanced
topic: Express.js Architecture
vibe_coding_ready: true
version: "4.x / 5.x"
tags: [best-practices, clean-code, expressjs, vibe-coding, cursor-rules, javascript, typescript, software-architecture, system-design, mvc, production-ready, programming-standards, node-js, design-patterns, scalable-code, windsurf-rules, ai-coding, enterprise-patterns, backend]
ai_role: Senior Express.js Architecture Expert
last_updated: 2026-03-27
last_evolution: 2026-03-27---
---

# 🏗️ Express.js Architecture Best Practices
66 changes: 31 additions & 35 deletions backend/expressjs/readme.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,12 @@
---
description: Vibe coding guidelines and architectural constraints for Express.js within the backend domain.
technology: Express.js
domain: backend
level: Senior/Architect
version: "4.x / 5.x"
tags: [best-practices, clean-code, expressjs, vibe-coding, cursor-rules, javascript, typescript, software-architecture, system-design, mvc, production-ready, programming-standards, node-js, design-patterns, scalable-code, windsurf-rules, ai-coding, enterprise-patterns, backend]
ai_role: Senior Express.js Backend Expert
last_updated: 2026-03-23
topic: Express.js
complexity: Architect
last_evolution: 2026-03-29
vibe_coding_ready: true---
---


<div align="center">
Expand Down Expand Up @@ -81,7 +77,7 @@ class UserController {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 2. Async/Await Error Wrapping (Express 4)
### ❌ Bad Practice
```javascript
Expand All @@ -97,7 +93,7 @@ router.get('/', asyncHandler(UserController.get));


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 3. Global Error Handler Middleware
### ❌ Bad Practice
```javascript
Expand All @@ -115,7 +111,7 @@ app.use((err, req, res, next) => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 4. Request Payload Validation (Joi / Zod)
### ❌ Bad Practice
```javascript
Expand All @@ -135,7 +131,7 @@ router.post('/', validate(userSchema), UserController.create);


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 5. Environment Variables separation
### ❌ Bad Practice
```javascript
Expand All @@ -151,7 +147,7 @@ mongoose.connect(process.env.DB_URI);


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 6. HTTP Security Headers (Helmet)
### ❌ Bad Practice
// Приложение светит 'X-Powered-By: Express'
Expand All @@ -165,7 +161,7 @@ app.use(helmet());


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 7. Cross-Origin Resource Sharing (CORS)
### ❌ Bad Practice
```javascript
Expand All @@ -181,7 +177,7 @@ app.use(cors({ origin: 'https://myapp.com', credentials: true }));


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 8. Rate Limiting (Защита от DDoS)
### ❌ Bad Practice
// API открыт для миллиона запросов в секунду
Expand All @@ -195,7 +191,7 @@ app.use('/api/', rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 9. Body Parsing & Payload Limits
### ❌ Bad Practice
```javascript
Expand All @@ -211,7 +207,7 @@ app.use(express.urlencoded({ extended: true, limit: '10kb' }));


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 10. Centralized Logging (Morgan + Winston)
### ❌ Bad Practice
```javascript
Expand All @@ -227,7 +223,7 @@ winstonLogger.info('User signed in');


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 11. Database Connection Management
### ❌ Bad Practice
```javascript
Expand All @@ -244,7 +240,7 @@ mongoose.connect(process.env.DB_URI).then(() => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 12. JWT Authentication Middleware
### ❌ Bad Practice
```javascript
Expand All @@ -264,7 +260,7 @@ const authGuard = (req, res, next) => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 13. Role-Based Access Control (RBAC) Middleware
### ❌ Bad Practice
```javascript
Expand All @@ -283,7 +279,7 @@ router.delete('/:id', requireRole('admin', 'manager'), Controller.del);


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 14. Standard API Response Wrapper
### ❌ Bad Practice
```javascript
Expand All @@ -301,7 +297,7 @@ class ApiResponse {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 15. Pagination details in API
### ❌ Bad Practice
```javascript
Expand All @@ -318,7 +314,7 @@ res.json({ data: users, meta: { total, page, limit, pages: Math.ceil(total/limit


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 16. Graceful Shutdown
### ❌ Bad Practice
// При получении SIGTERM сервер моментально обрывает процессы
Expand All @@ -335,7 +331,7 @@ process.on('SIGTERM', () => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 17. 404 Route Handler
### ❌ Bad Practice
// Если роут не найден, возвращается пустая белая страница
Expand All @@ -350,7 +346,7 @@ app.use('*', (req, res) => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 18. Application Structure (Folder organization)
### ❌ Bad Practice
```
Expand All @@ -371,7 +367,7 @@ src/


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 19. Health Check Endpoint
### ❌ Bad Practice
// Нет проверки жизнеспособности подов Kubernetes
Expand All @@ -386,7 +382,7 @@ app.get('/health', (req, res) => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 20. Data Sanitization (XSS / NoSQL Injection)
### ❌ Bad Practice
```javascript
Expand All @@ -404,7 +400,7 @@ app.use(xss());


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 21. Swagger / OpenAPI documentation
### ❌ Bad Practice
// Документация в стороннем Word-файле
Expand All @@ -419,7 +415,7 @@ app.use('/api-docs', swaggerUi.serve, swaggerUi.setup(swaggerDocument));


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 22. Manual Dependency Injection
### ❌ Bad Practice
```javascript
Expand All @@ -437,7 +433,7 @@ const controller = new UserController(new UserService(db));


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 23. File Uploads (Multer)
### ❌ Bad Practice
// Парсинг бинарников руками
Expand All @@ -452,7 +448,7 @@ router.post('/avatar', upload.single('file'), Controller.upload);


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 24. Event Emitters (Фоновые задачи)
### ❌ Bad Practice
```javascript
Expand All @@ -473,7 +469,7 @@ res.send('Welcome');


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 25. Caching (Redis Middleware)
### ❌ Bad Practice
// БД обрабатывает сложные расчеты на каждый хит
Expand All @@ -491,7 +487,7 @@ const cacheMiddleware = (req, res, next) => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 26. Custom Error Classes
### ❌ Bad Practice
```javascript
Expand All @@ -513,7 +509,7 @@ throw new AppError('User not found', 404);


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 27. Proxy Trust in Production
### ❌ Bad Practice
```javascript
Expand All @@ -528,7 +524,7 @@ app.set('trust proxy', 1); // Доверяем первому прокси


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 28. Separating Server from App
### ❌ Bad Practice
```javascript
Expand All @@ -549,7 +545,7 @@ app.listen(3000);


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 29. UUID Request Correlation
### ❌ Bad Practice
// Ошибки в логах невозможно связать с конкретным пользователем
Expand All @@ -567,7 +563,7 @@ app.use((req, res, next) => {


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
## 30. Secure Session Management
### ❌ Bad Practice
// Сессия хранится в памяти (MemoryStore) с открытыми куками
Expand All @@ -591,4 +587,4 @@ app.use(session({


### ⚠️ Problem
[Analysis of the risks]
Insecure or unoptimized implementation that can cause performance bottlenecks, maintainability issues, or security vulnerabilities. It deviates from modern deterministic standards, making the code harder for AI Agents and Senior Developers to parse and safely extend.
6 changes: 1 addition & 5 deletions backend/expressjs/security-best-practices.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,11 @@
---
description: Vibe coding guidelines and architectural constraints for Express.js Security within the backend domain.
technology: Express.js
domain: backend
level: Senior/Architect
complexity: Advanced
topic: Express.js Security
vibe_coding_ready: true
version: "4.x / 5.x"
tags: [best-practices, clean-code, security-patterns, vibe-coding, cursor-rules, expressjs, software-architecture, system-design, solid-principles, production-ready, programming-standards, node-js, security, scalable-code, windsurf-rules, ai-coding, enterprise-patterns]
ai_role: Senior Express.js Security Expert
last_updated: 2026-03-27
last_evolution: 2026-03-27---
---

# 🔒 Express.js Security Best Practices
8 changes: 2 additions & 6 deletions backend/microservices/api-design.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,11 @@
---
description: Vibe coding guidelines and architectural constraints for Microservices API Design within the backend domain.
technology: Microservices
domain: backend
level: Architect
complexity: Architect
topic: Microservices API Design
vibe_coding_ready: true
level: Senior/Architect
version: Agnostic
tags: [best-practices, clean-code, architecture-patterns, vibe-coding, microservices, distributed-systems, system-design, solid-principles, production-ready, scalable-code]
ai_role: Senior Microservices Architect
last_updated: 2026-03-27
last_evolution: 2026-03-27---
---

# 🧩 Microservices API Design
8 changes: 2 additions & 6 deletions backend/microservices/architecture.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,11 @@
---
description: Vibe coding guidelines and architectural constraints for Microservices Architecture within the backend domain.
technology: Microservices
domain: backend
level: Architect
complexity: Architect
topic: Microservices Architecture
vibe_coding_ready: true
level: Senior/Architect
version: Agnostic
tags: [best-practices, clean-code, architecture-patterns, vibe-coding, microservices, distributed-systems, system-design, solid-principles, production-ready, scalable-code]
ai_role: Senior Microservices Architect
last_updated: 2026-03-27
last_evolution: 2026-03-27---
---

# 🧩 Microservices Architecture
8 changes: 2 additions & 6 deletions backend/microservices/readme.md
Original file line number Diff line number Diff line change
@@ -1,16 +1,12 @@
---
description: Vibe coding guidelines and architectural constraints for Microservices within the backend domain.
technology: Microservices
domain: backend
level: Architect
complexity: Architect
topic: Microservices
vibe_coding_ready: true
level: Senior/Architect
version: Agnostic
tags: [best-practices, clean-code, architecture-patterns, vibe-coding, microservices, distributed-systems, system-design, solid-principles, production-ready, scalable-code]
ai_role: Senior Microservices Architect
last_updated: 2026-03-27
last_evolution: 2026-03-27---
---


<div align="center">
Expand Down
8 changes: 2 additions & 6 deletions backend/microservices/security-best-practices.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,11 @@
---
description: Vibe coding guidelines and architectural constraints for Microservices Security within the backend domain.
technology: Microservices
domain: backend
level: Architect
complexity: Architect
topic: Microservices Security
vibe_coding_ready: true
level: Senior/Architect
version: Agnostic
tags: [best-practices, clean-code, architecture-patterns, vibe-coding, microservices, distributed-systems, system-design, solid-principles, production-ready, scalable-code]
ai_role: Senior Microservices Architect
last_updated: 2026-03-27
last_evolution: 2026-03-27---
---

# 🧩 Microservices Security Best Practices
Loading
Loading