The part that has to work when nobody's watching.

APIs, databases, authentication, and the infrastructure underneath — built to handle real traffic and real data without falling over. We favor boring, well-understood tools (Postgres, Node/Python, standard REST or GraphQL) over clever ones, because boring is what's still running in two years.

Every endpoint is built with input validation and rate limiting from day one, not bolted on after an incident.