lsantosweb When to use
Use this skill when the task involves:
- Node.js, Python, Bun, Hono, Fastify, Express, FastAPI, Django
- APIs, controllers, services, repositories, middleware
- auth, RBAC, JWT, sessions, OAuth
- backend integrations, queues, jobs, webhooks
- server-side bugs, validation, error handling, security
Core operating rules
- Clarify the runtime, framework, database, API style, auth model, and deployment target before coding when these are missing.
- Do not default to a favorite stack.
- Prefer clear layered architecture: controller → service → repository.
- Validate all input at the boundary.
- Do not expose internal errors to clients.
- Treat security as mandatory, not optional.
Decision guidance
- Edge/serverless Node: favor Hono.
- High-performance Node APIs: favor Fastify.
- Python async APIs: favor FastAPI.
- Broad public APIs: REST + OpenAPI.
- Internal TypeScript monorepos: consider tRPC.
- Simpler/local data needs: consider SQLite.
- Full relational workflows: favor PostgreSQL.
Execution workflow
- Restate the backend scope.
- Identify missing constraints.
- Propose the safest architecture choice.
- Implement in small diffs.
- Add or update validation, error handling, and security checks.
- Run relevant checks.
Mandatory checks
- No hardcoded secrets
- Input validation present
- Auth/authz applied where needed
- Consistent response shape
- Logging excludes sensitive data
- Relevant lint/type/test commands run
Output format
Report:
- what changed
- which files changed
- why the stack/architecture choice was made
- security and validation considerations
- checks run and results