# Vibe Coding 101

> Look up the term. Paste the prompt.

For developers who ship with an agent and need the normal engineering word, not a longer prompt.

A public glossary of 277 engineering terms for vibe coding, across software engineering, backend, frontend, security, data, machine learning, cloud, concurrency, networking, UX, mobile, games, and system design. Cite the canonical page for a term. Each page answers what it is, why it matters when a model writes the code, how to do it, the prompt to paste, and the common failure.

## How to cite

- Prefer the canonical URL under https://vibe-coding-101.brighteng.org/c/<id>/
- Quote the opening definition and the "How do you ask a model" line
- Full text of every term: https://vibe-coding-101.brighteng.org/llms-full.txt
- Index: https://vibe-coding-101.brighteng.org/

## loop

How you work. TDD, reverse engineering, skeletons, stranglers. The model writes the code. You choose the method.

- [test-driven development](https://vibe-coding-101.brighteng.org/c/tdd/) (the outer loop of red-green-refactor): Write a failing test first, then make the implementation pass. The test is the spec. The code is fill.
- [reverse engineering](https://vibe-coding-101.brighteng.org/c/reverse-engineering/) (taking a living system apart): Recover a spec from a finished thing: behaviour, data, edges. Not copying pixels — extracting a testable contract.
- [characterization test](https://vibe-coding-101.brighteng.org/c/characterization-test/) (golden master): Snapshot what the system does today, then change it. Not the ideal — the actual.
- [spike](https://vibe-coding-101.brighteng.org/c/spike/): Code you intend to throw away, written only to answer one unknown. Stop when the clock hits.
- [walking skeleton](https://vibe-coding-101.brighteng.org/c/walking-skeleton/): A path so thin it is almost bone, but it walks end to end: deploy, sign in, write one row, read it back.
- [tracer bullet](https://vibe-coding-101.brighteng.org/c/tracer-bullet/): One live round: a small feature through every layer, leaving a visible trace so you can correct aim.
- [vertical slice](https://vibe-coding-101.brighteng.org/c/vertical-slice/): Ship one user-visible sliver at a time, instead of finishing a layer.
- [refactoring](https://vibe-coding-101.brighteng.org/c/refactoring/): Change structure, keep behaviour. An edit with no tests is not a refactor. It is a rewrite.
- [strangler fig](https://vibe-coding-101.brighteng.org/c/strangler-fig/): Grow a new skin around the old system, take it over piece by piece, let the old wood die. No big-bang rewrite.

## spec

How you pin the thing down. Types, scenarios, a noun list. A mood is not a spec.

- [spec-driven](https://vibe-coding-101.brighteng.org/c/spec-driven/): A checkable spec before generated code. Shorter than the chat, harder than a vibe.
- [types as spec](https://vibe-coding-101.brighteng.org/c/types-as-spec/): Write the data shape as types first, and let the compiler shout at the model.
- [behaviour-driven development](https://vibe-coding-101.brighteng.org/c/bdd/) (Given-When-Then): Specify with scenarios: given, when, then. A human can read them. A test can run them.
- [ubiquitous language](https://vibe-coding-101.brighteng.org/c/ubiquitous-language/): The same word for the same thing in the chat, the code, and the tests. The noun list is the spec.
- [YAGNI](https://vibe-coding-101.brighteng.org/c/yagni/): You aren’t gonna need it. Do not let the model build the abstraction nobody asked for.
- [minimum viable product](https://vibe-coding-101.brighteng.org/c/mvp/): The smallest version that tests one hypothesis — not a complete product with fewer buttons.
- [contract-first](https://vibe-coding-101.brighteng.org/c/contract-first/): Freeze the interface — types, OpenAPI, events — then fill both sides.

## agent

How the model runs, and how you stop it. Context, tools, review, evals.

- [vibe coding](https://vibe-coding-101.brighteng.org/c/vibe-coding/): Drive a model to edit the repo in natural language. You review the diff, run the tests, name the move — syntax is not the first job.
- [prompt as spec](https://vibe-coding-101.brighteng.org/c/prompt-as-spec/): Write the prompt as a ticket: objects, constraints, acceptance, what not to do. Not a mood.
- [context engineering](https://vibe-coding-101.brighteng.org/c/context-engineering/): Control what the model can see right now. Only the papers this turn needs stay on the table.
- [tool use](https://vibe-coding-101.brighteng.org/c/tool-use/): The model does not only talk — it runs commands, edits files, clicks a browser. Every step must be stoppable.
- [human in the loop](https://vibe-coding-101.brighteng.org/c/human-in-the-loop/): The model proposes, the human nods, then it moves. Irreversible steps halt.
- [evals](https://vibe-coding-101.brighteng.org/c/evals/): Score the prompt on a fixed task set. A vibe is not a regression suite.
- [guardrails](https://vibe-coding-101.brighteng.org/c/guardrails/): What the agent must not do, as mechanical limits: paths, commands, permissions, spend.
- [diff review](https://vibe-coding-101.brighteng.org/c/diff-review/): The human job is the diff, not the file. If you have not seen what moved, you do not merge.

## feedback

How you know this round is right. Red tests, CI, fakes, a repro, one e2e. Eyeballing is not enough.

- [red-green-refactor](https://vibe-coding-101.brighteng.org/c/red-green-refactor/): TDD’s metronome: red, then green, then tidy. Skipping a beat is a bet.
- [CI as judge](https://vibe-coding-101.brighteng.org/c/ci-as-judge/): The merge key belongs to the pipeline, not to a vibe. Local green is not court. CI is.
- [linter loop](https://vibe-coding-101.brighteng.org/c/linter-loop/): Treat lint and type errors as the model’s compiler. The red text is spec, not insult.
- [snapshot test](https://vibe-coding-101.brighteng.org/c/snapshot-test/): Pin output to a file. If it changes, red. Good for characterization. Bad at asserting intent.
- [property-based testing](https://vibe-coding-101.brighteng.org/c/property-based/): Do not only write examples. Write a property that must always hold, and let a generator try to break it.
- [repro](https://vibe-coding-101.brighteng.org/c/repro/): Steps that make the bug happen on a clean machine. Without a repro, the model is guessing.
- [end-to-end test](https://vibe-coding-101.brighteng.org/c/e2e/) (e2e): A script that drives the real UI through a real user path. Slow, few, precious.
- [flaky test](https://vibe-coding-101.brighteng.org/c/flaky-test/): A test that fails without a product bug: time, order, network, leftover state. Delete or fix. Never retry to green.
- [test double](https://vibe-coding-101.brighteng.org/c/test-double/) (mock, stub, fake): A stand-in for a collaborator. A fake has behavior. A mock only remembers it was called.

## model

Hallucination, system prompts, MCP, tokens, temperature, sandboxes. Words about the model itself.

- [hallucination](https://vibe-coding-101.brighteng.org/c/hallucination/): The model states a missing API, file, or fact as if it were real. Calm tone is not evidence.
- [system prompt](https://vibe-coding-101.brighteng.org/c/system-prompt/): The standing instructions above the chat: who the model is, what it may touch, how it should fail.
- [few-shot](https://vibe-coding-101.brighteng.org/c/few-shot/): Show two or three worked examples in the prompt. The model copies the shape, not your adjectives.
- [structured output](https://vibe-coding-101.brighteng.org/c/structured-output/): Force JSON or a schema. Prose from a model is a suggestion. A schema is a contract.
- [MCP](https://vibe-coding-101.brighteng.org/c/mcp/) (Model Context Protocol): A standard way to plug tools and data into the model: issue trackers, browsers, docs, databases.
- [token budget](https://vibe-coding-101.brighteng.org/c/token-budget/): The window is finite. Every file you add crowds out the one that mattered.
- [temperature](https://vibe-coding-101.brighteng.org/c/temperature/): A knob for randomness. Code wants it low. Brainstorming can stand it higher.
- [sandbox](https://vibe-coding-101.brighteng.org/c/sandbox/): A sealed place the agent can run commands. Network, filesystem, and secrets are opt-in.
- [plan then act](https://vibe-coding-101.brighteng.org/c/plan-then-act/): The model writes the steps. You approve. Then it may touch files. Not the other way around.
- [compaction](https://vibe-coding-101.brighteng.org/c/compaction/) (context rot): When the window fills, the agent summarises the chat. Details die in the summary. Pin what must live.

## ship

Secrets, migrations, idempotency, flags, rollbacks. The layer the model fakes fluency in, and where it blows up.

- [env and secrets](https://vibe-coding-101.brighteng.org/c/env-secrets/): Keys live in the environment, never in the repo, never in the prompt if you can help it.
- [migration](https://vibe-coding-101.brighteng.org/c/migration/): A versioned, reversible change to the schema. Not “edit the database until it works.”
- [idempotency](https://vibe-coding-101.brighteng.org/c/idempotency/): Doing it twice has the same result as doing it once. Clicks, webhooks, and retries need this.
- [feature flag](https://vibe-coding-101.brighteng.org/c/feature-flag/): Ship the code dark. Turn it on for some people. Turn it off without a rollback of the whole site.
- [rollback](https://vibe-coding-101.brighteng.org/c/rollback/): A rehearsed way back. If you cannot undo the deploy, you did not finish the change.

## engineering

Dependency injection, leaky abstractions, semver, observability. Software-engineering names the model will not pick unless you do.

- [dependency injection](https://vibe-coding-101.brighteng.org/c/dependency-injection/) (DI): Pass collaborators in. Do not let a function new up the world.
- [separation of concerns](https://vibe-coding-101.brighteng.org/c/separation-of-concerns/): UI does not own the rule. The rule does not own SQL. Each file has one reason to change.
- [leaky abstraction](https://vibe-coding-101.brighteng.org/c/leaky-abstraction/): The wrapper still forces you to know what is underneath. Then it is not a wrapper.
- [technical debt](https://vibe-coding-101.brighteng.org/c/technical-debt/): A shortcut with interest. Write down the principal, the interest, and the due date.
- [semver](https://vibe-coding-101.brighteng.org/c/semver/) (semantic versioning): MAJOR breaks callers. MINOR adds. PATCH fixes. The number is a promise, not a vibe.
- [breaking change](https://vibe-coding-101.brighteng.org/c/breaking-change/): Existing callers fail without edits. Renames, removed fields, stricter validation.
- [observability](https://vibe-coding-101.brighteng.org/c/observability/) (logs, metrics, traces): Logs say what happened. Metrics say how often. Traces say which hop was slow.
- [architecture decision record](https://vibe-coding-101.brighteng.org/c/adr/) (ADR): A short note: the decision, the context, the options you rejected. So next month’s chat does not relitigate it.
- [invariant](https://vibe-coding-101.brighteng.org/c/invariant/): A fact that must stay true. Balance not negative. A child row never outlives its parent.
- [composition over inheritance](https://vibe-coding-101.brighteng.org/c/composition/): Has-a, not is-a. Assemble small pieces. Do not grow a base class the model keeps subclassing.

## backend

REST, auth, N+1, money, time zones, transactions, queues. The server words a model writes fluently and wrongly.

- [N+1 query](https://vibe-coding-101.brighteng.org/c/n-plus-one/): One query to list N rows, then one query per row. Fine at 3. Dead at 300.
- [webhook](https://vibe-coding-101.brighteng.org/c/webhook/): Their server hits yours when something happens. Verify the signature. Do not trust the browser return.
- [REST](https://vibe-coding-101.brighteng.org/c/rest/): Resources and verbs the HTTP spec already has. GET reads. PUT replaces. POST creates. DELETE removes.
- [authn vs authz](https://vibe-coding-101.brighteng.org/c/authn-authz/) (authentication vs authorization): Authn is who you are. Authz is what you may do. Logging in is not permission.
- [pagination](https://vibe-coding-101.brighteng.org/c/pagination/) (cursor vs offset): Do not return the whole table. Offset pages lie under inserts. Cursors stay stable.
- [rate limit](https://vibe-coding-101.brighteng.org/c/rate-limit/): A cap on how often a caller may hit you. 429, not a meltdown.
- [transaction](https://vibe-coding-101.brighteng.org/c/transaction/) (ACID): Several writes that commit together or not at all. A half-saved order is a bug.
- [database index](https://vibe-coding-101.brighteng.org/c/db-index/): A lookup structure so the query does not read the whole table. Indexes match the WHERE and the ORDER BY.
- [cache invalidation](https://vibe-coding-101.brighteng.org/c/cache-invalidation/): A cache is a lie with a deadline. Say who deletes it, and when.
- [job queue](https://vibe-coding-101.brighteng.org/c/job-queue/): Work that must not live inside the request: mail, thumbnails, webhooks you send. Durable, retried, idempotent.
- [circuit breaker](https://vibe-coding-101.brighteng.org/c/circuit-breaker/): Stop calling a dependency that is already failing. Fail fast, then try again later.
- [graceful shutdown](https://vibe-coding-101.brighteng.org/c/graceful-shutdown/): On SIGTERM, stop taking work, finish what you started, then exit. Do not drop the request mid-write.
- [event loop](https://vibe-coding-101.brighteng.org/c/event-loop/) (microtask, macrotask, Node event loop): One thread runs your JavaScript. A long synchronous call blocks every request on it.
- [GIL](https://vibe-coding-101.brighteng.org/c/gil/) (global interpreter lock, CPython): CPython runs one thread of bytecode at a time. Threads do not speed up a pure Python loop.
- [ownership](https://vibe-coding-101.brighteng.org/c/ownership/) (borrow checker, Rust lifetimes): One owner. Borrows are temporary. Cloning to silence the checker keeps the cost forever.
- [goroutine](https://vibe-coding-101.brighteng.org/c/goroutine/) (Go channel, goroutine leak): A goroutine is cheap to start and easy to leak. Cancel it, or it runs until the process dies.
- [minor units](https://vibe-coding-101.brighteng.org/c/minor-units/) (cents, money integer, decimal scale): Money is an integer of the smallest unit, plus a currency. It is not a float.
- [UTC vs local time](https://vibe-coding-101.brighteng.org/c/utc-local/) (timezone, DST, civil date): Store an instant in UTC. Store a birthday as a date. Do not confuse the two.
- [optimistic concurrency](https://vibe-coding-101.brighteng.org/c/optimistic-lock/) (version column, ETag, compare-and-swap): Write only if the version you read is still current. Zero rows updated means someone else wrote.
- [partial update](https://vibe-coding-101.brighteng.org/c/partial-update/) (PATCH, JSON Merge Patch): PATCH changes the fields it names. A missing field is left alone, not cleared.
- [transaction isolation](https://vibe-coding-101.brighteng.org/c/isolation/) (read committed, repeatable read, serializable): The default isolation level is not “as if one at a time.” Serializable can fail, and you retry.
- [DTO](https://vibe-coding-101.brighteng.org/c/dto/) (response model, mass assignment): The API type is not the table type. Do not bind a request onto the entity.
- [prepared statement](https://vibe-coding-101.brighteng.org/c/prepared-statement/) (parameterized query, bind parameter): The SQL string is constant. Values are parameters. Escaping quotes is not that.
- [WebSocket](https://vibe-coding-101.brighteng.org/c/websocket/) (socket, upgrade handshake): A WebSocket is a long-lived connection. Auth happens on the upgrade, and a slow client must not fill memory.
- [error as value](https://vibe-coding-101.brighteng.org/c/error-as-value/) (Result, Go error): Return the error or throw it. Do not do both, and do not swallow either.
- [request scope](https://vibe-coding-101.brighteng.org/c/request-scope/) (unit of work, scoped session): One database session for the request. Close it before you return. Do not share it.
- [option type](https://vibe-coding-101.brighteng.org/c/option-type/) (Option, Maybe, null vs undefined): Missing, null, and empty are three states. Do not collapse them at the door.
- [DataLoader](https://vibe-coding-101.brighteng.org/c/dataloader/) (request-scoped batching): Collect ids during one request and load them in one query. The cache dies with the request.
- [middleware order](https://vibe-coding-101.brighteng.org/c/middleware-order/) (middleware pipeline): The first middleware sees the request first. Auth at the bottom of the stack is auth that never runs in time.

## mobile

Offline, deep links, safe areas, push, lifecycle, secure storage, background limits. Phone nouns. Not a shrunk website.

- [offline-first](https://vibe-coding-101.brighteng.org/c/offline-first/): The phone is the source of truth until the network returns. Queue writes. Do not pretend you are online.
- [deep link](https://vibe-coding-101.brighteng.org/c/deep-link/): A URL that opens a specific screen, not just the app icon. Cold start must land there too.
- [safe area](https://vibe-coding-101.brighteng.org/c/safe-area/): The notch, the home indicator, the status bar. Content lives inside the inset, not under the glass.
- [navigation stack](https://vibe-coding-101.brighteng.org/c/navigation-stack/): Screens push and pop. Back goes to the previous screen, not to whatever the model rendered last.
- [push notification](https://vibe-coding-101.brighteng.org/c/push-notification/): The OS delivers a message while you are not running. Tapping it is a deep link, not a mystery.
- [app lifecycle](https://vibe-coding-101.brighteng.org/c/app-lifecycle/): Foreground, background, killed. Resume must not assume the screen you left is still valid.
- [OS permission](https://vibe-coding-101.brighteng.org/c/os-permission/): Camera, photos, location, notifications. Ask when the need is obvious. Survive “don’t allow.”
- [haptic](https://vibe-coding-101.brighteng.org/c/haptic/): A small tap from the hardware when something commits. Not a vibration on every pixel.
- [OTA update](https://vibe-coding-101.brighteng.org/c/ota-update/) (over-the-air): Ship JS without a store review. You still cannot OTA a native change, and you must be able to roll it back.
- [list virtualization](https://vibe-coding-101.brighteng.org/c/list-virtualization/): Render the rows on screen, not the ten thousand off screen. Recycle views.
- [sync conflict](https://vibe-coding-101.brighteng.org/c/conflict/): Two edits of the same row while offline. You must pick a rule: merge, reject, or ask.
- [secure storage](https://vibe-coding-101.brighteng.org/c/secure-storage/) (Keychain, Keystore): Tokens live in the keychain or the keystore. AsyncStorage is not a safe.
- [app link](https://vibe-coding-101.brighteng.org/c/app-link/) (universal link, Android App Link): An https URL the OS has verified belongs to your app. A custom scheme is not that.
- [background execution](https://vibe-coding-101.brighteng.org/c/background-execution/) (BGTask, foreground service): The OS suspends your app. A timer is not a background job.
- [app extension](https://vibe-coding-101.brighteng.org/c/app-extension/) (widget, share extension): A widget or a share sheet is a separate process with a small memory budget.
- [adaptive layout](https://vibe-coding-101.brighteng.org/c/adaptive-layout/) (size class, window size class): A tablet is a different layout, not a phone screen stretched.
- [in-app purchase](https://vibe-coding-101.brighteng.org/c/in-app-purchase/) (StoreKit, Play Billing): The store charges the user. Your server decides what that unlocked.
- [build variant](https://vibe-coding-101.brighteng.org/c/build-variant/) (scheme, product flavor, bundle id): Debug and release are different apps. They do not share a bundle id or a push key.
- [native bridge](https://vibe-coding-101.brighteng.org/c/native-bridge/) (platform channel, React Native bridge): UI and native code exchange structured messages. They do not share objects.
- [dynamic type](https://vibe-coding-101.brighteng.org/c/dynamic-type/) (Dynamic Type, font scale): The user sets a larger text size. The layout has to survive the largest one.
- [launch screen](https://vibe-coding-101.brighteng.org/c/launch-screen/) (splash screen): The launch screen is a static picture the OS shows. It is not a place to fetch.
- [biometric](https://vibe-coding-101.brighteng.org/c/biometric/) (Face ID, BiometricPrompt): The face or fingerprint unlocks a key already on the device. It is not a password you send.
- [background location](https://vibe-coding-101.brighteng.org/c/background-location/) (always authorization, significant-change location): Location after the app closes is a separate permission, and you have to earn it.

## desktop

Main process, IPC, signing, windows, trays. A desktop app is not a website in a frame.

- [main process vs renderer](https://vibe-coding-101.brighteng.org/c/main-process/) (Electron main, Tauri core): The shell process owns the files and the OS. The window is a guest.
- [IPC](https://vibe-coding-101.brighteng.org/c/ipc/) (inter-process communication, contextBridge): A named channel between the window and the shell. Not a function that runs anything.
- [context isolation](https://vibe-coding-101.brighteng.org/c/context-isolation/) (nodeIntegration off, contextBridge): The page cannot see Node, even if it is compromised.
- [single instance](https://vibe-coding-101.brighteng.org/c/single-instance/) (single instance lock): The second launch focuses the window that is already open. It does not start another copy.
- [code signing](https://vibe-coding-101.brighteng.org/c/code-signing/) (notarization, Gatekeeper, Authenticode): The OS checks who signed the binary. Unsigned apps are blocked, not just warned, on current systems.
- [desktop auto-update](https://vibe-coding-101.brighteng.org/c/desktop-update/) (Sparkle, Squirrel, electron-updater): Download a signed build, check it, and swap it on quit. Do not overwrite a running binary.
- [protocol handler](https://vibe-coding-101.brighteng.org/c/protocol-handler/) (file association, custom URL scheme): The OS opens your app for a scheme or a file type. The already-running instance must receive it.
- [window state](https://vibe-coding-101.brighteng.org/c/window-state/) (window bounds, multi-monitor): Remember where the window was. If that display is gone, open it on a display that exists.
- [tray](https://vibe-coding-101.brighteng.org/c/tray/) (menu bar extra, system tray, NSStatusItem): Closing the window does not quit a tray app. Quitting is a menu item.
- [native dialog](https://vibe-coding-101.brighteng.org/c/native-dialog/) (open panel, save panel): Open and save go through the OS dialog. The path it returns is the permission.
- [app sandbox](https://vibe-coding-101.brighteng.org/c/app-sandbox/) (entitlements, App Sandbox): The OS allowlist for a desktop app. Entitlements are the permission, not a comment.
- [webview](https://vibe-coding-101.brighteng.org/c/webview/) (WKWebView, WebView2): A browser inside the app. Remote pages do not get the app’s files or IPC.
- [app packaging](https://vibe-coding-101.brighteng.org/c/app-packaging/) (DMG, MSI, MSIX, AppImage): The installer is the product the OS sees. A folder of files is not an install.
- [global shortcut](https://vibe-coding-101.brighteng.org/c/global-shortcut/) (global hotkey, accelerator): A global hotkey fires even when another app is focused. An in-window shortcut does not.
- [native menu](https://vibe-coding-101.brighteng.org/c/native-menu/) (application menu, menu role): Use the OS menu bar. Roles give you undo, quit, and the window menu for free.

## game

Game loop, delta time, collision, sprite sheets, object pools. Name them or the model invents a slideshow.

- [game loop](https://vibe-coding-101.brighteng.org/c/game-loop/): Input, update, render, repeat. Not a chain of setTimeouts that drift.
- [delta time](https://vibe-coding-101.brighteng.org/c/delta-time/): Move by time, not by frames. A slow machine must not make the jump shorter.
- [entity component system](https://vibe-coding-101.brighteng.org/c/ecs/) (ECS): Entities are ids. Components are data. Systems are the functions. Do not build a God class named Player.
- [collision](https://vibe-coding-101.brighteng.org/c/collision/): Detect overlap, then resolve it. Detection without a response is a highlight, not physics.
- [sprite sheet](https://vibe-coding-101.brighteng.org/c/sprite-sheet/): Many frames in one image. The game draws a rectangle, not a new file per frame.
- [state machine](https://vibe-coding-101.brighteng.org/c/state-machine/): Explicit states and the only legal transitions. Idle can go to run. Dead cannot go to jump.
- [object pool](https://vibe-coding-101.brighteng.org/c/object-pool/): Reuse bullets and particles. Allocating every shot is how the frame hitch arrives.
- [hitbox and hurtbox](https://vibe-coding-101.brighteng.org/c/hitbox/): Where you deal damage, and where you take it. They are not the sprite’s rectangle.
- [camera follow](https://vibe-coding-101.brighteng.org/c/camera-follow/): The camera eases toward the player. It does not glue to their pixels, and it does not show past the level.
- [save game](https://vibe-coding-101.brighteng.org/c/save-game/): Serialize the sim, not the sprites. Version the blob. Load must survive an old file.
- [frame budget](https://vibe-coding-101.brighteng.org/c/frame-budget/): A 60fps frame has about 16ms. If you spend 20, you are not at 60. Measure before you decorate.

## system design

Load balancers, shards, replicas, eventual consistency, sagas, canaries. The names that show up once one machine is not enough.

- [load balancer](https://vibe-coding-101.brighteng.org/c/load-balancer/): One address, many machines. It spreads requests and stops sending them to a dead one.
- [horizontal scaling](https://vibe-coding-101.brighteng.org/c/horizontal-scaling/) (scale out, not up): More machines, not a bigger one. That only works if no single process owns the user.
- [CDN](https://vibe-coding-101.brighteng.org/c/cdn/): Static bytes cached near the user. HTML that changes per person usually does not belong there.
- [CAP theorem](https://vibe-coding-101.brighteng.org/c/cap/): During a partition you choose: answer with stale or different data, or stop answering. You do not get both.
- [replication](https://vibe-coding-101.brighteng.org/c/replication/): Copies of the same data on more than one node. Copies drift unless you say how writes propagate.
- [sharding](https://vibe-coding-101.brighteng.org/c/sharding/): Split rows across databases by a key. The key is the product decision. A bad key is a hot shard.
- [consistent hashing](https://vibe-coding-101.brighteng.org/c/consistent-hashing/): Adding a node moves only some keys, not all of them. That is the point of the ring.
- [read replica](https://vibe-coding-101.brighteng.org/c/read-replica/): Copies that serve reads. They lag. A read-your-writes screen must not use them.
- [eventual consistency](https://vibe-coding-101.brighteng.org/c/eventual-consistency/): If writes stop, copies agree. Until then they may disagree. The UI has to admit that.
- [saga](https://vibe-coding-101.brighteng.org/c/saga/): A multi-step business action with a compensating step for each. Not a distributed transaction you hoped would exist.
- [transactional outbox](https://vibe-coding-101.brighteng.org/c/outbox/): Write the row and the “please publish this event” in the same database transaction. A worker publishes after.
- [cache stampede](https://vibe-coding-101.brighteng.org/c/cache-stampede/) (thundering herd): The hot key expires and every request rebuilds it at once. One recomputation. The rest wait or get stale.
- [hot key](https://vibe-coding-101.brighteng.org/c/hot-key/): One key gets a disproportionate share of traffic. The shard that owns it falls over. The others look idle.
- [backpressure](https://vibe-coding-101.brighteng.org/c/backpressure/): When the consumer is slow, the producer must slow down or shed. An unbounded queue is a delayed outage.
- [load shedding](https://vibe-coding-101.brighteng.org/c/load-shed/): Refuse the cheap requests so the expensive, important ones still finish. A polite 503 beats a timeout for everyone.
- [dead-letter queue](https://vibe-coding-101.brighteng.org/c/dead-letter/): Jobs that failed enough times go somewhere a human can see. They do not retry forever, and they do not vanish.
- [liveness and readiness](https://vibe-coding-101.brighteng.org/c/liveness-readiness/): Liveness: the process is not stuck, so restart it. Readiness: it can take traffic, so leave it out of the balancer until it can.
- [canary deploy](https://vibe-coding-101.brighteng.org/c/canary/): A small slice of traffic gets the new version first. If it burns, everyone else never sees it.
- [single point of failure](https://vibe-coding-101.brighteng.org/c/spof/): The one box, file, or person whose death takes the system with it. Name it before you draw more boxes.
- [failover](https://vibe-coding-101.brighteng.org/c/failover/): A named promotion when the primary dies. If you have never run it, you do not have it.
- [pub/sub](https://vibe-coding-101.brighteng.org/c/pub-sub/): Publishers do not know the subscribers. Each subscriber gets the event. A work queue is the opposite: one consumer does the job.
- [tail latency](https://vibe-coding-101.brighteng.org/c/tail-latency/): The average can look fine while the slowest 1% makes the page feel broken. Watch the tail.
- [timeout budget](https://vibe-coding-101.brighteng.org/c/timeout-budget/): The user gave you one second. Every hop spends from that second. Do not give each hop its own one second.
- [graceful degradation](https://vibe-coding-101.brighteng.org/c/graceful-degradation/): A dependency is down and the product still does the core job, minus the ornament.
- [bulkhead](https://vibe-coding-101.brighteng.org/c/bulkhead/): Separate pools so one noisy feature cannot sink the rest. Ships use them so one leak does not flood every compartment.
- [quorum](https://vibe-coding-101.brighteng.org/c/quorum/): A majority must agree before a write is real. Two nodes out of three is enough. One node must not be.
- [backend for frontend](https://vibe-coding-101.brighteng.org/c/bff/) (BFF): A thin API shaped for one client. The mobile app does not assemble five microservice calls on a flaky radio.

## frontend

Hydration, SSR, hooks, keys, specificity, focus. Browser words. The model will ship a div with a click handler if you do not say them.

- [debounce](https://vibe-coding-101.brighteng.org/c/debounce/) (often paired with throttle): Wait until the action pauses, then run it. Search boxes, not every keystroke.
- [optimistic UI](https://vibe-coding-101.brighteng.org/c/optimistic-ui/): Paint the success first. If the server refuses, roll back. Do not make the user wait on a like.
- [SSR / SSG / SPA](https://vibe-coding-101.brighteng.org/c/ssr/): Where the HTML is born: server on request, at build time, or only in the browser. Search, first paint, and auth all change.
- [hydration](https://vibe-coding-101.brighteng.org/c/hydration/): The server HTML is already there. Hydration attaches events without redrawing a different tree.
- [code splitting](https://vibe-coding-101.brighteng.org/c/code-splitting/): The first screen does not download the admin editor. Load a route when the user opens it.
- [tree shaking](https://vibe-coding-101.brighteng.org/c/tree-shaking/): Dead exports are dropped from the bundle. A side-effect import keeps the whole module.
- [controlled input](https://vibe-coding-101.brighteng.org/c/controlled-input/): React state owns the value, or the DOM does. Mixing them makes the cursor jump and the submit lie.
- [reflow and repaint](https://vibe-coding-101.brighteng.org/c/reflow/): Reading layout in a loop forces the browser to recalculate. Write styles, then read once.
- [progressive enhancement](https://vibe-coding-101.brighteng.org/c/progressive-enhancement/): The basic action works as HTML. Script makes it better. Script must not be the only way.
- [focus management](https://vibe-coding-101.brighteng.org/c/focus-management/): When a dialog opens, focus goes inside it. When it closes, focus returns. Tab does not escape to the page underneath.
- [client state vs server state](https://vibe-coding-101.brighteng.org/c/client-server-state/): Server state is cached data from someone else. Client state is the draft, the tab, the open menu. Do not put both in one store.
- [critical rendering path](https://vibe-coding-101.brighteng.org/c/critical-path/): What the browser must have before it can paint. Everything else waits.
- [islands architecture](https://vibe-coding-101.brighteng.org/c/islands/): The page is static HTML. Small interactive regions hydrate. The article is not a client app.
- [rules of hooks](https://vibe-coding-101.brighteng.org/c/rules-of-hooks/) (React hooks): Call hooks at the top level, in the same order every render. The order is their identity.
- [effect dependencies](https://vibe-coding-101.brighteng.org/c/effect-deps/) (useEffect deps): The dependency array is the list of values the effect reads. An empty array means mount and unmount only.
- [list key](https://vibe-coding-101.brighteng.org/c/list-key/) (reconciliation key): The key is the item’s identity. The index is the slot, and the slot moves.
- [stale closure](https://vibe-coding-101.brighteng.org/c/stale-closure/) (stale props, stale state): The callback still sees the state from the render that created it.
- [CSS specificity](https://vibe-coding-101.brighteng.org/c/css-specificity/) (the cascade, cascade layers): When two rules match, specificity and order decide. Adding !important is not a decision.
- [stacking context](https://vibe-coding-101.brighteng.org/c/stacking-context/) (z-index): z-index only compares elements inside the same stacking context.
- [server components](https://vibe-coding-101.brighteng.org/c/server-components/) (RSC, use client): A server component ships no client JavaScript. It cannot use state or effects.
- [suspense](https://vibe-coding-101.brighteng.org/c/suspense/) (Suspense boundary): A suspense boundary shows a fallback while a child waits. It is not a try/catch.
- [event delegation](https://vibe-coding-101.brighteng.org/c/event-delegation/) (bubbling, capturing): One listener on a parent handles events from the children. stopPropagation cuts that off.
- [service worker](https://vibe-coding-101.brighteng.org/c/service-worker/) (service worker update): A worker that can answer fetches. A bad cache serves yesterday’s app to today’s user.
- [web storage](https://vibe-coding-101.brighteng.org/c/web-storage/) (localStorage, sessionStorage, IndexedDB): localStorage is a synchronous string bucket. It is not a session and not a database.
- [structural typing](https://vibe-coding-101.brighteng.org/c/structural-typing/) (duck typing, TypeScript excess property check): TypeScript checks the shape, not the name. A type assertion throws that check away.
- [shadow DOM](https://vibe-coding-101.brighteng.org/c/shadow-dom/) (shadow root, web component): A shadow root keeps page CSS out and component CSS in. The global sheet does not cross it.
- [container query](https://vibe-coding-101.brighteng.org/c/container-query/) (@container): Style the component from the size of its parent, not the size of the window.
- [reactivity](https://vibe-coding-101.brighteng.org/c/reactivity/) (signals, Vue reactivity): A signal updates the computations that read it. Assigning state in React does not do that mid-render.

## security

XSS, CSRF, prompt injection, broken access control, hashing, OAuth. The holes a model writes while the demo still looks fine.

- [row-level security](https://vibe-coding-101.brighteng.org/c/rls/) (RLS): Not “are you logged in,” but “is this row yours.” Hide the button and refuse the query.
- [cross-site scripting](https://vibe-coding-101.brighteng.org/c/xss/) (XSS): Untrusted text becomes HTML or script. Escape by default. `dangerouslySetInnerHTML` is a decision, not a convenience.
- [cross-site request forgery](https://vibe-coding-101.brighteng.org/c/csrf/) (CSRF): Another site submits your logged-in user’s cookie. State-changing requests need a token the other site cannot read.
- [SQL injection](https://vibe-coding-101.brighteng.org/c/sql-injection/): User input becomes part of the query string. Bind parameters. Do not concatenate.
- [server-side request forgery](https://vibe-coding-101.brighteng.org/c/ssrf/) (SSRF): The server fetches a URL the user supplied. That URL can be your metadata service or localhost.
- [insecure direct object reference](https://vibe-coding-101.brighteng.org/c/idor/) (IDOR): The id in the URL is a guess. Authorization is per object, not “any logged-in user.”
- [password hashing](https://vibe-coding-101.brighteng.org/c/password-hashing/): Store a slow hash, not the password, not SHA-256, not encryption you can undo.
- [OAuth and OIDC](https://vibe-coding-101.brighteng.org/c/oauth/): OAuth delegates access. OIDC is login on top of it. The id token is not the access token.
- [content security policy](https://vibe-coding-101.brighteng.org/c/csp/) (CSP): The browser only runs script from places you named. Inline script is how XSS survives.
- [CORS](https://vibe-coding-101.brighteng.org/c/cors/): The browser asks your server whether another origin may read the response. `*` plus cookies is not a configuration.
- [least privilege](https://vibe-coding-101.brighteng.org/c/least-privilege/): The token, the database user, and the process can do only the one job. Admin is not the default.
- [threat model](https://vibe-coding-101.brighteng.org/c/threat-model/): Who attacks, what they want, what they already have. Controls come after that, not before.
- [supply-chain attack](https://vibe-coding-101.brighteng.org/c/supply-chain/): The code you did not write runs with your privileges. Pin it. Review the install script.
- [session cookie](https://vibe-coding-101.brighteng.org/c/session-cookie/): HttpOnly, Secure, SameSite. The script does not need to read the session token.
- [prompt injection](https://vibe-coding-101.brighteng.org/c/prompt-injection/) (indirect prompt injection): Untrusted text is obeyed as an instruction. A page, a ticket, or a tool result can retask the model.

## data

OLTP versus OLAP, ETL, partitions, CDC, backfills. An analytics path is not “another table.”

- [OLTP vs OLAP](https://vibe-coding-101.brighteng.org/c/oltp-olap/): OLTP is the app’s transactions. OLAP is the scan that answers a question. Do not run the question on the checkout database.
- [ETL and ELT](https://vibe-coding-101.brighteng.org/c/etl/): Extract, then transform, then load — or load raw and transform in the warehouse. Do not transform in a notebook you cannot rerun.
- [columnar storage](https://vibe-coding-101.brighteng.org/c/columnar/): Store a column together so a scan of one field does not read the whole row. Wrong tool for “fetch this order.”
- [table partitioning](https://vibe-coding-101.brighteng.org/c/partitioning/): Physically split a table by a key, usually time, so a day can be dropped or scanned alone.
- [change data capture](https://vibe-coding-101.brighteng.org/c/cdc/) (CDC): Read the database log of changes instead of polling tables. The log is the stream.
- [backfill](https://vibe-coding-101.brighteng.org/c/backfill/): Recompute history after the rule changes. Do it in slices. Do not lock the live table to rewrite the past.
- [watermark](https://vibe-coding-101.brighteng.org/c/watermark/): The time you believe the stream is complete up to. Late events after that need a rule.
- [star schema](https://vibe-coding-101.brighteng.org/c/star-schema/): Facts in the middle, dimensions around them. The fact row is a measurement. The dimension is a noun you filter on.
- [data lineage](https://vibe-coding-101.brighteng.org/c/lineage/): Which inputs produced this number. If you cannot say, you cannot fix the dashboard.
- [denormalization](https://vibe-coding-101.brighteng.org/c/denormalization/): Copy a value to avoid a join. You now have two writers. Say who updates the copy.
- [schema evolution](https://vibe-coding-101.brighteng.org/c/schema-evolution/): Old files and new code must both still read. Adding a field is easy. Changing a meaning is not.
- [idempotent pipeline](https://vibe-coding-101.brighteng.org/c/idempotent-pipeline/): Running yesterday’s job again replaces yesterday. It does not add yesterday twice.
- [batch vs stream](https://vibe-coding-101.brighteng.org/c/batch-stream/): Batch has a bounded input and a finish. A stream does not finish. Do not use a stream because it sounds alive.

## machine learning

Overfitting, leakage, retrieval, fine-tuning, drift. Training and serving a model, not prompting one.

- [overfitting](https://vibe-coding-101.brighteng.org/c/overfitting/): The model memorized the training rows. It looks brilliant on them and wrong on the next ones.
- [data leakage](https://vibe-coding-101.brighteng.org/c/leakage/): The features contain the answer, or the future. The offline score is fiction.
- [train-serve skew](https://vibe-coding-101.brighteng.org/c/train-serve-skew/): The feature in training is not the feature in production. Same name, different code.
- [embedding](https://vibe-coding-101.brighteng.org/c/embedding/): A vector that puts similar things near each other. It is not a summary you can read, and it is not search by itself.
- [retrieval-augmented generation](https://vibe-coding-101.brighteng.org/c/rag/) (RAG): Fetch passages, then let the model answer from those passages. The retrieve step is the product. The prompt is not.
- [fine-tuning](https://vibe-coding-101.brighteng.org/c/fine-tuning/): Continue training on your examples. It does not replace a missing fact, and it is not the first thing to try.
- [holdout set](https://vibe-coding-101.brighteng.org/c/holdout/): Data the model never trains on and you rarely look at. It is the only honest number.
- [baseline](https://vibe-coding-101.brighteng.org/c/baseline/): The dumb method you have to beat: predict the mean, the last value, or the rule you already run.
- [drift](https://vibe-coding-101.brighteng.org/c/drift/): The world moved. The model did not. Inputs changed, or the meaning of the label changed.
- [quantization](https://vibe-coding-101.brighteng.org/c/quantization/): Fewer bits per weight. Smaller and faster. Measure the quality drop. Do not assume it is free.
- [inference](https://vibe-coding-101.brighteng.org/c/inference/): Running the trained model on new inputs. Training is the other, heavier loop. Do not do training inside the request.

## cloud

Infrastructure as code, containers, cold starts, tenants, GitOps. How machines are built and replaced.

- [infrastructure as code](https://vibe-coding-101.brighteng.org/c/iac/) (IaC): The servers are a reviewable diff. Clicking the console is how the next environment drifts.
- [immutable infrastructure](https://vibe-coding-101.brighteng.org/c/immutable-infra/): Replace the server. Do not SSH in and patch it. The next boot matches the build.
- [container](https://vibe-coding-101.brighteng.org/c/container/): A process with its filesystem pinned. It is not a VM, and “works on my machine” is the image, not the laptop.
- [cold start](https://vibe-coding-101.brighteng.org/c/cold-start/): The first request pays for process start. After idle, it pays again. Do not put a 2-second boot on a user click.
- [multi-tenancy](https://vibe-coding-101.brighteng.org/c/multi-tenancy/): Many customers share a system. A bug that forgets the tenant id is a data breach, not a glitch.
- [object storage](https://vibe-coding-101.brighteng.org/c/object-storage/): Blobs addressed by key. Not a filesystem, not a database, not something you append to in place.
- [region and zone](https://vibe-coding-101.brighteng.org/c/region-zone/): A zone is a data center. A region is a group of them. Two instances in one zone are one fire.
- [GitOps](https://vibe-coding-101.brighteng.org/c/gitops/): Git is the source of what should be running. A controller makes the cluster match. A laptop deploy is drift.
- [twelve-factor app](https://vibe-coding-101.brighteng.org/c/twelve-factor/): Config in the environment. State in a backing service. Processes are disposable. Logs go to stdout.
- [blue-green deploy](https://vibe-coding-101.brighteng.org/c/blue-green/): Two full environments. Traffic flips from old to new. Flip back if the new one is wrong.
- [configuration drift](https://vibe-coding-101.brighteng.org/c/config-drift/): What is running is not what is in git. Someone fixed production by hand.
- [serverless](https://vibe-coding-101.brighteng.org/c/serverless/): You do not run the server. You still own cold starts, limits, and the bill per invocation.

## concurrency

Races, deadlock, mutexes, async versus parallel, cancellation. Things that happen at the same time. Not a faster for-loop.

- [race condition](https://vibe-coding-101.brighteng.org/c/race-condition/): The later request finishes first. Search, double-submit, and “check then set” all hit this.
- [deadlock](https://vibe-coding-101.brighteng.org/c/deadlock/): Two waiters each hold what the other needs. Nobody proceeds. Always take locks in one order.
- [mutex](https://vibe-coding-101.brighteng.org/c/mutex/): Only one holder enters. It is not a suggestion, and it does not work across processes unless you bought a distributed lock.
- [async vs parallel](https://vibe-coding-101.brighteng.org/c/async-parallel/): Async waits without blocking a thread. Parallel uses more than one core. They are not synonyms.
- [thread pool](https://vibe-coding-101.brighteng.org/c/thread-pool/): A fixed set of workers. Extra work waits. Unbounded thread creation is how you run out of memory.
- [actor model](https://vibe-coding-101.brighteng.org/c/actor/): Each actor has a mailbox and private state. Others send messages. They do not touch its memory.
- [cancellation](https://vibe-coding-101.brighteng.org/c/cancellation/): When the caller gives up, the work stops. A request that outlived the user still holds a database connection.
- [memory leak](https://vibe-coding-101.brighteng.org/c/memory-leak/): The process keeps memory it will never use again. Caches without a bound and listeners without an unsubscribe are the usual doors.
- [lock contention](https://vibe-coding-101.brighteng.org/c/lock-contention/): Everyone queues on one lock. The lock is correct and the throughput is gone.
- [atomic operation](https://vibe-coding-101.brighteng.org/c/atomic/): The update happens entirely or not at all, even when two threads do it. A read-modify-write of a normal variable is not atomic.

## network

TCP, TLS, DNS, pools, head-of-line blocking. How bytes move. Timeout is not the only word.

- [TCP vs UDP](https://vibe-coding-101.brighteng.org/c/tcp-udp/): TCP is a reliable ordered stream. UDP is datagrams. You do not “just use UDP” for a file upload.
- [TLS](https://vibe-coding-101.brighteng.org/c/tls/): Encryption and identity on the wire. HTTPS is HTTP inside TLS. Turning off verification is not a dev mode to ship.
- [DNS](https://vibe-coding-101.brighteng.org/c/dns/): Names to addresses, cached longer than you think. A failover that depends on DNS is a failover with a TTL.
- [connection pool](https://vibe-coding-101.brighteng.org/c/connection-pool/): Reuse connections. A new TCP and TLS handshake per query will dominate the query.
- [head-of-line blocking](https://vibe-coding-101.brighteng.org/c/head-of-line/): One slow item at the front of a single queue stalls everything behind it. Split the queue or the connection.
- [HTTP caching](https://vibe-coding-101.brighteng.org/c/http-cache/): Cache-Control tells the browser and the CDN what they may reuse. A missing header is not “no cache.” It is “guess.”
- [reverse proxy](https://vibe-coding-101.brighteng.org/c/reverse-proxy/): A server in front of your app that terminates clients and forwards inward. Your app is not exposed raw unless you mean it to be.
- [bandwidth vs latency](https://vibe-coding-101.brighteng.org/c/bandwidth-latency/): Bandwidth is how much per second. Latency is how long before the first byte. A fat pipe does not fix a chatty protocol.
- [TLS termination](https://vibe-coding-101.brighteng.org/c/tls-termination/): Where the encrypted session ends. After that hop, know whether the rest of the path is still trusted.
- [HTTP/2](https://vibe-coding-101.brighteng.org/c/http2/): Many requests on one connection. It removes a class of blocking and does not make a slow server fast.
- [packet loss](https://vibe-coding-101.brighteng.org/c/packet-loss/): Some packets never arrive. TCP hides it by waiting. A timeout that is shorter than retransmission makes a slow network look “down.”
- [keep-alive](https://vibe-coding-101.brighteng.org/c/keep-alive/): Reuse the TCP connection for the next request. Closing it every time repeats the handshake.

## ux

Empty states, accessibility, undo, destructive actions, skeletons. How the interface behaves when it is empty or wrong.

- [accessibility](https://vibe-coding-101.brighteng.org/c/a11y/) (a11y): Keyboard, names, contrast, motion. If you cannot tab to it, it is not a button.
- [empty state](https://vibe-coding-101.brighteng.org/c/empty-state/): The first time there is nothing, the screen explains why and what to do. A blank table is not a design.
- [progressive disclosure](https://vibe-coding-101.brighteng.org/c/progressive-disclosure/): Show the next decision when it becomes relevant. Do not show every setting on the first screen.
- [affordance](https://vibe-coding-101.brighteng.org/c/affordance/): The control looks like what it does. A button looks pressable. A non-button does not.
- [mental model](https://vibe-coding-101.brighteng.org/c/mental-model/): What the user thinks the system is doing. If the model is wrong, the UI taught the wrong story.
- [destructive action](https://vibe-coding-101.brighteng.org/c/destructive-action/): Delete, discard, revoke. It is not the primary color. Confirm if it cannot be undone. Offer undo if it can.
- [undo](https://vibe-coding-101.brighteng.org/c/undo/): The action can be reversed from the UI. A soft delete nobody can restore is not undo.
- [skeleton screen](https://vibe-coding-101.brighteng.org/c/skeleton/): A placeholder shaped like the content, shown while loading. Not a spinner in a void, and not a fake version of the data.
- [error copy](https://vibe-coding-101.brighteng.org/c/error-copy/): Say what happened and what to do next, in the user’s nouns. `ECONNRESET` is not copy.
- [onboarding](https://vibe-coding-101.brighteng.org/c/onboarding/): The shortest path to the first success. Not a tour of every button.
- [information architecture](https://vibe-coding-101.brighteng.org/c/information-architecture/): What the things are called and where they live. Navigation is that decision made visible.
- [perceived performance](https://vibe-coding-101.brighteng.org/c/perceived-performance/): How fast it feels. A slow task that shows progress feels faster than a fast task that freezes.
- [modal vs page](https://vibe-coding-101.brighteng.org/c/modal-vs-page/): A modal interrupts. A page is a place you can link to. If the user might refresh or share it, it is a page.