# LevelCode

> Free, in-depth lessons on frontend, Go, Node.js, Python, Rust, SQL, system design, security and AI engineering, each with worked examples, a practice task and a quiz.

LevelCode is a free learning site for software developers. Each roadmap is an ordered course split into stages; each step links to a full lesson page with explanations, worked code examples, a practice task with a hidden solution and a four-question quiz. "Pick one" steps offer alternative lessons (e.g. two styling approaches); role roadmaps embed skill roadmaps such as Git and SQL.

Every lesson is also published as Markdown: append `.md` to its URL (for example https://levelcode.org/roadmaps/frontend/how-the-web-works.md) for the full text, the practice solution and the quiz with answers.

## Role-based roadmaps

- [Software Engineer roadmap](https://levelcode.org/roadmaps/software-engineer): Fundamentals, both sides of the stack, software design — and the interviews that get you hired. Level: Beginner → Advanced.
- [Frontend Developer roadmap](https://levelcode.org/roadmaps/frontend): From your first HTML tag to shipping fast, accessible React apps. Level: Beginner → Advanced.
- [Backend with Go roadmap](https://levelcode.org/roadmaps/go-backend): Design, build and ship production HTTP services in Go. Level: Beginner → Advanced.
- [Backend with Node.js roadmap](https://levelcode.org/roadmaps/node-backend): Build production APIs in TypeScript on Node.js, from the event loop to deployment. Level: Beginner → Advanced.
- [Full-Stack Developer roadmap](https://levelcode.org/roadmaps/full-stack): Own a feature end to end: React in the browser, Node and PostgreSQL behind it, shipped as one. Level: Beginner → Advanced.
- [AI Engineer roadmap](https://levelcode.org/roadmaps/ai-engineer): Build reliable products on top of large language models. Level: Beginner → Advanced.
- [DevSecOps Engineer roadmap](https://levelcode.org/roadmaps/devsecops): Build security into every stage of how software is built and shipped. Level: Beginner → Advanced.

## Skill-based roadmaps

- [Learn to Code roadmap](https://levelcode.org/roadmaps/learn-to-code): Never programmed before? Start here and write real programs in Python. Level: Beginner.
- [Python roadmap](https://levelcode.org/roadmaps/python): From scripts to typed, tested, production Python: packages, async and web APIs. Level: Beginner → Advanced.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql): Query, model and tune relational databases with confidence. Level: Beginner → Advanced.
- [System Design roadmap](https://levelcode.org/roadmaps/system-design): Design systems that scale, stay correct and survive failure. Level: Intermediate.
- [Rust roadmap](https://levelcode.org/roadmaps/rust): Memory safety without a garbage collector — and the mental model that makes the compiler your ally. Level: Beginner → Advanced.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): Version control you actually understand — not just memorized commands. Level: Beginner.

## Concepts

Short single-topic notes, each on its own page (https://levelcode.org/concepts) and as Markdown at <concept URL>.md.

### System design: Requirements & scale

- [Clarifying requirements](https://levelcode.org/concepts/requirements-clarification): Turn a vague prompt into users, features, scale and constraints before drawing a single box.
- [Non-functional requirements](https://levelcode.org/concepts/non-functional-requirements): Latency, availability, durability, consistency and cost — written down as numbers.
- [Latency numbers to know](https://levelcode.org/concepts/latency-numbers): Memory, SSD, network and cross-region round trips, to the nearest order of magnitude.
- [Capacity estimation](https://levelcode.org/concepts/capacity-estimation): From daily users to requests per second, storage and bandwidth in a few lines of arithmetic.
- [Little's law](https://levelcode.org/concepts/littles-law): Work in progress equals throughput times latency — the formula behind pool, queue and fleet sizes.
- [Availability and the nines](https://levelcode.org/concepts/availability-and-nines): What 99.9% and 99.99% mean in minutes of downtime, and how serial dependencies multiply.
- [SLIs, SLOs and error budgets](https://levelcode.org/concepts/sli-slo-sla): Measure what users feel, set a target, and spend the slack on purpose.
- [Tail latency](https://levelcode.org/concepts/tail-latency): Why p99 matters more than the average, how fan-out amplifies it, and hedged requests.
- [Vertical vs horizontal scaling](https://levelcode.org/concepts/vertical-vs-horizontal-scaling): A bigger machine or more machines — and why the answer is usually "bigger, until it isn’t".
- [Stateless services](https://levelcode.org/concepts/stateless-services): Move sessions and files out of the server so any instance can answer any request.
- [Monolith vs microservices](https://levelcode.org/concepts/monolith-vs-microservices): What splitting a service buys you, what it costs, and the modular monolith in between.
- [When not to add infrastructure](https://levelcode.org/concepts/when-not-to-add-infrastructure): The cheapest, most reliable component is the one you never run.

### System design: Networking & APIs

- [TCP vs UDP](https://levelcode.org/concepts/tcp-vs-udp): Reliable ordered streams versus fire-and-forget datagrams, and why HTTP/3 runs on UDP.
- [HTTP/1.1, HTTP/2 and HTTP/3](https://levelcode.org/concepts/http-versions): Connection reuse, multiplexing, head-of-line blocking and QUIC.
- [REST, gRPC and GraphQL](https://levelcode.org/concepts/rest-vs-grpc): Three API styles and where each one fits: public APIs, service-to-service, and client-shaped reads.
- [Polling, SSE and WebSockets](https://levelcode.org/concepts/realtime-transports): Four ways to push updates to a client, and what each costs the server.
- [Content delivery networks](https://levelcode.org/concepts/cdn): Edge caches close to users: what they cache, how they invalidate, and what they protect.
- [API gateway vs load balancer](https://levelcode.org/concepts/api-gateway-vs-load-balancer): One spreads traffic; the other also authenticates, limits and routes by API.
- [Idempotency keys](https://levelcode.org/concepts/idempotency-keys): Make a retried POST do its work exactly once by remembering the client’s request key.
- [Keyset pagination](https://levelcode.org/concepts/keyset-pagination): Page through large tables with a cursor on an indexed key instead of OFFSET.

### System design: Storage & databases

- [B-trees vs LSM-trees](https://levelcode.org/concepts/b-tree-vs-lsm-tree): Update in place or append and compact: the two storage-engine designs and their trade-offs.
- [Write-ahead log](https://levelcode.org/concepts/write-ahead-log): Write the intent to an append-only log first, so a crash can always be replayed.
- [Relational vs NoSQL](https://levelcode.org/concepts/sql-vs-nosql): Key-value, document, wide-column and graph stores compared with a relational database.
- [Normalization vs denormalization](https://levelcode.org/concepts/normalization-vs-denormalization): Store each fact once, or copy it where it’s read — and how to keep the copies honest.
- [Object storage](https://levelcode.org/concepts/object-storage): Blobs by key at any scale: S3-style storage, presigned URLs and why files don’t go in the database.

### System design: Replication & partitioning

- [Leader–follower replication](https://levelcode.org/concepts/leader-follower-replication): One node takes writes and streams them to read replicas; sync, async and failover.
- [Replication lag anomalies](https://levelcode.org/concepts/replication-lag): Read-your-writes, monotonic reads and how to route reads around a lagging replica.
- [Quorum reads and writes](https://levelcode.org/concepts/quorums): With N replicas, R + W > N makes every read overlap the latest write.
- [Range vs hash partitioning](https://levelcode.org/concepts/sharding): Two ways to decide which shard owns a key, and what each does to range queries and hot spots.
- [Consistent hashing](https://levelcode.org/concepts/consistent-hashing): Place nodes and keys on a ring so adding a node moves about 1/N of the keys, not all of them.
- [Hot partitions and hot keys](https://levelcode.org/concepts/hot-partitions): When one key gets most of the traffic: detection, key salting, splitting and caching.
- [Secondary indexes on sharded data](https://levelcode.org/concepts/secondary-indexes-partitioned): Local indexes mean scatter-gather reads; global indexes mean distributed writes.

### System design: Caching

- [Caching patterns](https://levelcode.org/concepts/caching-patterns): Cache-aside, read-through, write-through and write-behind, side by side.
- [Eviction policies](https://levelcode.org/concepts/cache-eviction): LRU, LFU, FIFO and TTLs: deciding what to drop when the cache is full.
- [Cache invalidation](https://levelcode.org/concepts/cache-invalidation): Delete on write, version your keys, and know the race that leaves stale data behind.
- [Cache stampedes](https://levelcode.org/concepts/cache-stampede): One expiring hot key, a thousand simultaneous misses — and three ways to stop it.

### System design: Async work & messaging

- [Message queues vs event logs](https://levelcode.org/concepts/queue-vs-log): RabbitMQ/SQS-style queues delete what they deliver; Kafka-style logs keep it for replay.
- [Delivery guarantees](https://levelcode.org/concepts/delivery-semantics): At-most-once, at-least-once and "exactly-once" — and why the last one needs your help.
- [Idempotent consumers](https://levelcode.org/concepts/idempotent-consumers): Process a redelivered message twice and still get the effect once.
- [Transactional outbox](https://levelcode.org/concepts/transactional-outbox): Write the event in the same database transaction as the change, then relay it.
- [Dead-letter queues](https://levelcode.org/concepts/dead-letter-queues): Park the message that fails every time so it stops blocking the ones behind it.
- [Backpressure](https://levelcode.org/concepts/backpressure): Let a slow consumer slow the producer down instead of drowning in a growing queue.
- [Sagas](https://levelcode.org/concepts/saga-pattern): A multi-service transaction as a sequence of local steps with compensating actions.
- [Event sourcing and CQRS](https://levelcode.org/concepts/event-sourcing-cqrs): Store the events, derive the state — and read from models built for reading.

### System design: Reliability

- [Timeouts and deadlines](https://levelcode.org/concepts/timeouts): Every network call needs a bound, and the bound should shrink as the request travels.
- [Retries, backoff and jitter](https://levelcode.org/concepts/retries-with-backoff): Retry only what is safe, wait longer each time, add randomness, and cap the total.
- [Circuit breakers](https://levelcode.org/concepts/circuit-breakers): Stop calling a dependency that keeps failing, and probe it before trusting it again.
- [Bulkheads](https://levelcode.org/concepts/bulkheads): Separate pools for separate dependencies, so one slow neighbour can’t sink the ship.
- [Load shedding](https://levelcode.org/concepts/load-shedding): Reject some work early and cheaply so the rest still finishes on time.
- [Graceful degradation](https://levelcode.org/concepts/graceful-degradation): Serve a simpler page instead of an error page when a non-critical part is down.
- [Rate-limiting algorithms](https://levelcode.org/concepts/rate-limiting-algorithms): Fixed window, sliding log, sliding counter and token bucket, compared on the same traffic.

### System design: Consistency & coordination

- [CAP theorem](https://levelcode.org/concepts/cap-theorem): During a network partition, choose between answering and being linearizable.
- [PACELC](https://levelcode.org/concepts/pacelc): CAP covers partitions; PACELC adds the latency-versus-consistency trade-off the rest of the time.
- [Consistency models](https://levelcode.org/concepts/consistency-models): Linearizable, sequential, causal and eventual consistency, from strongest to weakest.
- [Clocks and ordering](https://levelcode.org/concepts/clocks-and-ordering): Why wall clocks can’t order events across machines, and what Lamport and vector clocks do instead.
- [Unique ID generation](https://levelcode.org/concepts/unique-ids): UUIDv4, UUIDv7, Snowflake IDs and ticket servers: uniqueness, ordering and index locality.
- [Leader election](https://levelcode.org/concepts/leader-election): Pick exactly one node to do a job — and survive the moment two nodes both think it’s them.
- [Leases and fencing tokens](https://levelcode.org/concepts/leases-and-fencing-tokens): A lock that expires, plus a number that lets storage reject the holder whose lease already ran out.
- [Consensus and Raft](https://levelcode.org/concepts/consensus-raft): How a majority of nodes agree on one ordered log, and why you rent this from etcd or ZooKeeper.
- [Two-phase commit](https://levelcode.org/concepts/two-phase-commit): Atomic commit across databases: prepare, then commit — and the coordinator that can block everyone.
- [Gossip protocols](https://levelcode.org/concepts/gossip-protocols): Spread membership and state by having each node talk to a few random peers.

### System design: Data structures for scale

- [Bloom filters](https://levelcode.org/concepts/bloom-filters): A few bits per item that answer "definitely not" or "probably yes" to set membership.
- [HyperLogLog](https://levelcode.org/concepts/hyperloglog): Count distinct users in 12 KB with about 1% error, and merge counts across servers.
- [Count-min sketch](https://levelcode.org/concepts/count-min-sketch): Approximate per-key counts in fixed memory, for heavy hitters and trending topics.
- [Geohashes and quadtrees](https://levelcode.org/concepts/geospatial-indexes): Turn latitude and longitude into keys you can index, so "nearby" becomes a range scan.
- [Merkle trees](https://levelcode.org/concepts/merkle-trees): Hash trees that find which parts of two large datasets differ by comparing a few hashes.
- [Inverted indexes](https://levelcode.org/concepts/inverted-index): Map each term to the documents that contain it — the structure behind full-text search.

### Databases & SQL: Writing queries

- [SQL’s logical query order](https://levelcode.org/concepts/sql-logical-order): FROM, WHERE, GROUP BY, HAVING, SELECT, ORDER BY — why an alias works in one clause and not another.
- [NULL and three-valued logic](https://levelcode.org/concepts/null-three-valued-logic): NULL means unknown, so comparisons return unknown — and NOT IN with a NULL returns nothing.
- [Join algorithms](https://levelcode.org/concepts/join-algorithms): Nested loop, hash and merge joins: how the planner actually matches rows, and when each wins.
- [The N+1 query problem](https://levelcode.org/concepts/n-plus-one-queries): One query for the list, then one more per row — the most common reason a page makes 500 queries.

### Databases & SQL: Transactions & indexes

- [ACID](https://levelcode.org/concepts/acid): Atomicity, consistency, isolation and durability: what a transaction promises and who keeps each promise.
- [Isolation levels and anomalies](https://levelcode.org/concepts/isolation-levels): Read committed, repeatable read and serializable — and the dirty reads, lost updates and write skew each one allows.
- [MVCC](https://levelcode.org/concepts/mvcc): Keep several versions of each row so readers never wait for writers, and clean up the old ones later.
- [Optimistic vs pessimistic locking](https://levelcode.org/concepts/optimistic-vs-pessimistic-locking): Lock the row before you change it, or check a version number when you write — and when each fits.
- [Composite and covering indexes](https://levelcode.org/concepts/composite-indexes): Column order decides which queries an index can serve; including columns lets it skip the table.
- [Zero-downtime migrations](https://levelcode.org/concepts/expand-contract-migrations): Expand the schema, move the code, backfill, then contract — so old and new code both work mid-deploy.

### Backend, Go & Rust: Go

- [Implicit interfaces](https://levelcode.org/concepts/go-interfaces): A Go type satisfies an interface just by having the methods — so define small interfaces where you use them.
- [Errors as values and wrapping](https://levelcode.org/concepts/error-wrapping): Return errors, add context with %w, and inspect the chain with errors.Is and errors.As.
- [Context and cancellation](https://levelcode.org/concepts/context-cancellation): One value that carries a deadline and a cancel signal through every call a request makes.
- [Data races](https://levelcode.org/concepts/data-races): Two goroutines, one variable, at least one write and no synchronization — and how the race detector finds it.

### Backend, Go & Rust: Rust

- [Ownership and moves](https://levelcode.org/concepts/ownership-and-moves): Every Rust value has exactly one owner; assigning or passing it moves ownership, and the owner’s scope decides when it’s freed.
- [The borrow checker](https://levelcode.org/concepts/borrow-checker): Many shared references or one mutable reference, never both — the compile-time rule behind Rust’s memory and thread safety.
- [Lifetimes](https://levelcode.org/concepts/rust-lifetimes): Annotations like 'a describe how long references stay valid and how outputs relate to inputs; they never extend anything’s life.
- [Result, Option and ?](https://levelcode.org/concepts/result-and-option): No null and no exceptions: absence is Option<T>, failure is Result<T, E>, and ? propagates both in one character.
- [Static vs dynamic dispatch](https://levelcode.org/concepts/static-vs-dynamic-dispatch): Generics compile a copy per type and call directly; trait objects share one copy and call through a vtable.
- [Interior mutability](https://levelcode.org/concepts/interior-mutability): Mutate through a shared reference with Cell, RefCell, Mutex or atomics — the aliasing rule still holds, checked at runtime.
- [Send and Sync](https://levelcode.org/concepts/send-and-sync): Two auto traits that say which types may move to or be shared with other threads — why safe Rust has no data races.
- [Lazy futures and async runtimes](https://levelcode.org/concepts/async-futures): A Rust future does nothing until polled; a runtime such as Tokio polls it and wakes it when I/O is ready.

### Backend, Go & Rust: Web services

- [Middleware](https://levelcode.org/concepts/middleware): Wrap a handler in another handler to add logging, auth or recovery to every request.
- [Connection pooling](https://levelcode.org/concepts/connection-pooling): Reuse a bounded set of database connections — and size the bound from latency, not guesswork.
- [Sessions vs tokens](https://levelcode.org/concepts/sessions-vs-tokens): A random ID the server looks up, or a signed token the server verifies — and what each costs at logout.
- [Password hashing](https://levelcode.org/concepts/password-hashing): Store a slow, salted hash — Argon2id or bcrypt — never the password and never a fast hash.
- [Liveness and readiness checks](https://levelcode.org/concepts/liveness-readiness): One probe asks “should I restart you?”, the other “should I send you traffic?” — mixing them up causes outages.
- [Graceful shutdown](https://levelcode.org/concepts/graceful-shutdown): On SIGTERM, stop taking new work, finish what’s in flight, then exit — so deploys drop no requests.
- [Logs, metrics and traces](https://levelcode.org/concepts/logs-metrics-traces): Three kinds of telemetry and the question each answers: what happened, how much, and where the time went.

### Frontend: The browser

- [The event loop](https://levelcode.org/concepts/event-loop): One thread, a task queue and a microtask queue — why a promise callback runs before a setTimeout.
- [How the browser renders a page](https://levelcode.org/concepts/critical-rendering-path): Parse, style, layout, paint and composite — and which CSS changes trigger which steps.
- [The cascade and specificity](https://levelcode.org/concepts/css-cascade): When two rules disagree: origin, layers, specificity, then order — and why !important is a smell.
- [Event bubbling and delegation](https://levelcode.org/concepts/event-delegation): Events travel up the tree, so one listener on a parent can handle every child — even ones added later.
- [Same-origin policy and CORS](https://levelcode.org/concepts/same-origin-policy-cors): The browser keeps pages from reading other origins’ responses; CORS headers are how a server opts in.
- [The accessibility tree and ARIA](https://levelcode.org/concepts/accessibility-tree): What a screen reader actually sees: roles, names and states — and why native elements beat ARIA.

### Frontend: Building apps

- [Rendering and reconciliation](https://levelcode.org/concepts/react-rendering): A state change re-runs your component; React diffs the result and touches only what changed.
- [Derived state vs effects](https://levelcode.org/concepts/derived-state): If you can compute it during render, don’t store it and don’t sync it with an effect.
- [Server state vs client state](https://levelcode.org/concepts/server-vs-client-state): Data you fetched is a cache of someone else’s truth; treat it like one instead of copying it into useState.
- [Narrowing and discriminated unions](https://levelcode.org/concepts/type-narrowing): Let TypeScript prove which case you’re in from a check you already wrote, and catch the case you forgot.
- [CSR, SSR, SSG and hydration](https://levelcode.org/concepts/rendering-strategies): Render in the browser, on each request or at build time — and the hydration cost of doing both.
- [Tree shaking and code splitting](https://levelcode.org/concepts/bundling-code-splitting): Ship only the code that’s used, and only when it’s needed.
- [Core Web Vitals](https://levelcode.org/concepts/core-web-vitals): LCP, INP and CLS: loading, responsiveness and visual stability, measured on real users at the 75th percentile.

### AI engineering: Models & prompting

- [Tokens and tokenization](https://levelcode.org/concepts/tokens): Models read and bill in sub-word tokens, not characters or words — and that explains a lot of odd behaviour.
- [Context windows](https://levelcode.org/concepts/context-windows): Everything the model sees on one call — prompt, history, documents and its own output — has to fit.
- [Temperature and sampling](https://levelcode.org/concepts/sampling-temperature): The model outputs probabilities; temperature and top-p decide how adventurously the next token is picked.
- [Few-shot prompting](https://levelcode.org/concepts/few-shot-prompting): Show the model two or three worked examples instead of describing the format in words.
- [Structured outputs](https://levelcode.org/concepts/structured-outputs): Get JSON that matches a schema every time — and still validate it, because valid isn’t the same as correct.
- [The tool-use loop](https://levelcode.org/concepts/tool-use-loop): The model asks for a tool call, your code runs it and sends the result back, and the loop repeats until it answers.

### AI engineering: Embeddings & retrieval

- [Embeddings and cosine similarity](https://levelcode.org/concepts/embedding-similarity): Turn text into a vector so “similar meaning” becomes “small angle”.
- [Approximate nearest-neighbour indexes](https://levelcode.org/concepts/ann-indexes): HNSW and IVF trade a little recall for searching millions of vectors in milliseconds.
- [Chunking documents](https://levelcode.org/concepts/chunking): Split documents into pieces small enough to match a question and big enough to answer it.
- [Hybrid search and reranking](https://levelcode.org/concepts/hybrid-search-reranking): Combine keyword and vector search, then let a reranker put the best few on top.

### AI engineering: LLMs in production

- [Prompt caching](https://levelcode.org/concepts/prompt-caching): Reuse the model’s work on an unchanged prompt prefix for a fraction of the price and latency.
- [Prompt injection](https://levelcode.org/concepts/prompt-injection): Text the model reads can carry instructions; any tool it can call is reachable by whoever wrote that text.
- [LLM-as-judge evaluation](https://levelcode.org/concepts/llm-as-judge): Grade open-ended outputs with a model and a rubric — after checking the grader agrees with you.
- [Decision models](https://levelcode.org/concepts/decision-models): Jev, Clef and similar models return a probability for each allowed answer instead of text — fast routing, scoring and yes/no gates.
- [Quantization](https://levelcode.org/concepts/quantization): Store weights in 8 or 4 bits instead of 16, so a model fits on a smaller GPU at a small cost in quality.

### Security & operations: Application & cloud security

- [STRIDE](https://levelcode.org/concepts/stride): Six questions — spoofing, tampering, repudiation, disclosure, denial of service, elevation — to ask of every part of a design.
- [Injection and parameterized queries](https://levelcode.org/concepts/sql-injection): Never build a query or command by pasting in user input; pass the input as a parameter instead.
- [XSS and Content Security Policy](https://levelcode.org/concepts/xss-and-csp): Untrusted text rendered as HTML becomes the attacker’s script; escaping prevents it and CSP limits the damage.
- [TLS and certificates](https://levelcode.org/concepts/tls): How a client proves it’s talking to the real server and agrees a key no one else can read — and what mTLS adds.
- [Least privilege](https://levelcode.org/concepts/least-privilege): Give each person, service and job only the access it needs, for only as long as it needs it.
- [Short-lived credentials with OIDC](https://levelcode.org/concepts/workload-identity): Let CI jobs and services trade a signed identity token for temporary cloud credentials — no stored keys.
- [SBOMs and build provenance](https://levelcode.org/concepts/sbom-and-provenance): A list of what’s inside an artifact, and a signed record of where and how it was built.

### Security & operations: Running systems

- [Namespaces and cgroups](https://levelcode.org/concepts/container-isolation): A container is a normal Linux process with a restricted view (namespaces) and a budget (cgroups).
- [Desired state and reconciliation](https://levelcode.org/concepts/reconciliation-loops): Declare what should exist; a controller keeps comparing it with what does and closes the gap.
- [Rolling, blue-green and canary deploys](https://levelcode.org/concepts/deployment-strategies): Three ways to replace running code, and how each limits how many users a bad release reaches.
- [RPO and RTO](https://levelcode.org/concepts/rpo-rto): How much data you can afford to lose and how long you can afford to be down — the two numbers behind every backup plan.

### Git: How Git works

- [Git’s object model](https://levelcode.org/concepts/git-object-model): Blobs, trees and commits, each named by the hash of its content — a snapshot store, not a diff store.
- [Working tree, index and HEAD](https://levelcode.org/concepts/git-three-areas): Three copies of your files — and every “undo” command is about which of them it changes.
- [Branches, refs and HEAD](https://levelcode.org/concepts/git-refs): A branch is a file holding one commit hash; HEAD says which branch you’re on.
- [The reflog](https://levelcode.org/concepts/reflog): Git’s record of everywhere HEAD and each branch has pointed — how you get back a commit you “lost”.

### Git: Merging & history

- [Fast-forward vs merge commits](https://levelcode.org/concepts/fast-forward-merge): If the target hasn’t moved, Git just slides the pointer; otherwise it records a commit with two parents.
- [Three-way merges and conflicts](https://levelcode.org/concepts/three-way-merge): Git compares both sides with their common ancestor; a conflict is a line both sides changed.
- [Merge vs rebase](https://levelcode.org/concepts/merge-vs-rebase): Keep the true shape of history, or replay your commits on top for a straight line — and never rebase shared commits.
- [git bisect](https://levelcode.org/concepts/git-bisect): Binary-search history for the commit that broke something: 1,000 commits take about 10 tests.
- [Trunk-based development](https://levelcode.org/concepts/trunk-based-development): Everyone merges small changes to main at least daily and hides unfinished work behind flags.

### Engineering practice: Algorithms & complexity

- [Big-O notation](https://levelcode.org/concepts/big-o-notation): How an algorithm’s time or memory grows with input size, ignoring constants — so you can rule out approaches before running them.
- [Hash tables](https://levelcode.org/concepts/hash-tables): Hash a key to pick a bucket for average O(1) insert, lookup and delete — the structure behind maps, sets and caches.
- [Graph traversal: BFS and DFS](https://levelcode.org/concepts/graph-traversal): Visit reachable nodes level by level with a queue or path by path with a stack — shortest paths, components and topological order.
- [Dynamic programming](https://levelcode.org/concepts/dynamic-programming): Solve overlapping subproblems once and reuse the answers: define the state, the transition, the base cases and the order.

### Engineering practice: Code design

- [Coupling and cohesion](https://levelcode.org/concepts/coupling-and-cohesion): Keep what changes together in one place and minimise what each part knows about the others.
- [Guard clauses and the arrow anti-pattern](https://levelcode.org/concepts/guard-clauses): Check failure conditions first and return early, so the main path stays unindented instead of vanishing into nested ifs.
- [DRY: don’t repeat yourself](https://levelcode.org/concepts/dry): Every piece of knowledge needs one authoritative home — duplicated rules, not code that merely looks alike.
- [KISS: keep it simple](https://levelcode.org/concepts/kiss): Prefer the design with the fewest moving parts that meets the requirements; obvious code beats clever code.
- [YAGNI: you aren’t gonna need it](https://levelcode.org/concepts/yagni): Don’t build features or generality before a real requirement needs them — but keep the tests and structure that make adding them cheap.
- [Command–query separation](https://levelcode.org/concepts/command-query-separation): A method either answers a question or changes state, not both — so asking never changes the answer.
- [Law of Demeter](https://levelcode.org/concepts/law-of-demeter): Talk only to immediate collaborators: ask an object to do something instead of reaching through its internals.
- [Composition over inheritance](https://levelcode.org/concepts/composition-over-inheritance): Build behaviour by combining small objects that delegate to each other, rather than extending class hierarchies.
- [Code smells](https://levelcode.org/concepts/code-smells): Surface signs — long functions, data clumps, feature envy, shotgun surgery — that hint at a design problem worth refactoring.

### Engineering practice: SOLID principles

- [Single responsibility principle](https://levelcode.org/concepts/single-responsibility): A module should have one reason to change — it answers to one actor — so changes requested by different people don’t collide.
- [Open–closed principle](https://levelcode.org/concepts/open-closed): Add new behaviour by adding code rather than editing tested code, at the points where variation is real.
- [Liskov substitution principle](https://levelcode.org/concepts/liskov-substitution): Every implementation must honour the interface’s full behavioural contract, so callers can use any of them safely.
- [Interface segregation principle](https://levelcode.org/concepts/interface-segregation): Clients shouldn’t depend on methods they don’t use: prefer small, client-specific interfaces.
- [Dependency inversion principle](https://levelcode.org/concepts/dependency-inversion): Business logic owns the interfaces it needs and infrastructure implements them, so dependencies point toward policy.

### Engineering practice: Testing practice

- [Red, green, refactor](https://levelcode.org/concepts/red-green-refactor): The TDD loop: write a failing test, make it pass with the simplest code, then clean up with the tests green.
- [The test pyramid](https://levelcode.org/concepts/test-pyramid): Many fast unit tests, fewer integration tests and a handful of end-to-end tests — and why the opposite shape fails.
- [Test doubles: stubs, spies, mocks and fakes](https://levelcode.org/concepts/test-doubles): The five kinds of stand-in for a real dependency, and why outcome-based fakes usually beat interaction mocks.

### Engineering practice: Architecture & domain modeling

- [Package by feature](https://levelcode.org/concepts/package-by-feature): Organise code by business capability instead of technical layer, so a change stays in one place and boundaries can be enforced.
- [Ports and adapters](https://levelcode.org/concepts/ports-and-adapters): Hexagonal architecture: the application defines ports and the outside world plugs in through adapters.
- [Ubiquitous language](https://levelcode.org/concepts/ubiquitous-language): One shared vocabulary for developers and domain experts, used in conversation, documents and the code.
- [Bounded contexts](https://levelcode.org/concepts/bounded-contexts): A boundary inside which one model and its language are consistent — the main tool for splitting large systems.
- [Aggregates](https://levelcode.org/concepts/aggregates): A cluster of domain objects changed as one unit through a root that enforces its invariants — DDD’s consistency boundary.
- [Value objects](https://levelcode.org/concepts/value-objects): Small immutable types defined by their values — Money, Email, DateRange — that validate themselves and replace primitives.

### Engineering practice: Laws of software engineering

- [Conway's law](https://levelcode.org/concepts/conways-law): A system’s structure ends up mirroring the communication structure of the organization that builds it.
- [Wirth's law](https://levelcode.org/concepts/wirths-law): Software gets slower faster than hardware gets faster, so the speed users feel tends to stand still.
- [Hyrum's law](https://levelcode.org/concepts/hyrums-law): With enough users, every observable behavior of your API is depended on by someone, whatever the contract says.
- [Goodhart's law](https://levelcode.org/concepts/goodharts-law): When a measure becomes a target, it stops being a good measure, because people optimize the number, not the goal.
- [Cunningham's law](https://levelcode.org/concepts/cunninghams-law): The fastest way to get a right answer is often to post a wrong one: people correct more readily than they answer.
- [Mooers's law](https://levelcode.org/concepts/mooers-law): People won’t use an information system when having the information is more painful than not having it.
- [Linus's law](https://levelcode.org/concepts/linus-law): “Given enough eyeballs, all bugs are shallow” — the open-source claim about review, and why the evidence for it is thin.
- [Brooks's law](https://levelcode.org/concepts/brooks-law): Adding people to a late software project makes it later, because new people cost time before they save any.
- [Hofstadter's law](https://levelcode.org/concepts/hofstadters-law): It always takes longer than you expect, even when you take Hofstadter’s law into account.
- [Eagleson's law](https://levelcode.org/concepts/eaglesons-law): Code you wrote six months ago might as well be someone else’s, so write it for a reader who has none of your context.

## Interactive labs

Browser simulations from the lessons, each on its own page (https://levelcode.org/labs).

- [Box model](https://levelcode.org/labs/box-model) (CSS): Change padding, border, margin and box-sizing and watch the rendered size of an element change.
- [Flexbox playground](https://levelcode.org/labs/flexbox-playground) (CSS): Flip direction, justify, align and wrap on a live flex container until the axes make sense.
- [Event loop](https://levelcode.org/labs/event-loop) (JavaScript): Step through the call stack, microtasks and tasks to see exactly when each callback runs.
- [Go channels](https://levelcode.org/labs/channel-sim) (Go): Send, receive and close on buffered and unbuffered channels and see who blocks, and when.
- [SQL joins](https://levelcode.org/labs/join-visualizer) (SQL): Run INNER, LEFT, RIGHT, FULL and CROSS joins on the same two tables and compare the rows.
- [Index vs sequential scan](https://levelcode.org/labs/index-scan) (SQL): Count the pages a sequential scan and a B-tree index lookup read to find one row.
- [Git graph](https://levelcode.org/labs/git-graph) (Git): Type real Git commands and watch commits, branches and HEAD move on a live commit graph.
- [Tokenizer](https://levelcode.org/labs/tokenizer) (AI): Split text into tokens with a toy vocabulary and see why code and rare words cost more.
- [Next-token sampling](https://levelcode.org/labs/next-token) (AI): Adjust temperature, switch between greedy and sampled decoding, and watch each candidate token’s odds shift.
- [Embedding space](https://levelcode.org/labs/embedding-space) (AI): Drop a query into a 2-D embedding space and rank its nearest neighbours by cosine similarity.
- [chmod calculator](https://levelcode.org/labs/chmod-calculator) (Linux): Toggle read, write and execute per class and read the octal mode and ls -l string together.
- [IAM policy evaluator](https://levelcode.org/labs/iam-evaluator) (Cloud): Evaluate AWS IAM policies against a request and trace why it is allowed or denied.
- [Threat model explorer](https://levelcode.org/labs/threat-model) (Security): Walk a data-flow diagram, find the trust-boundary crossings and apply STRIDE to each flow.
- [NetworkPolicy reachability](https://levelcode.org/labs/network-policy) (Kubernetes): Apply Kubernetes NetworkPolicies and see which Pods can still reach which.
- [HPA autoscaling](https://levelcode.org/labs/autoscaling-sim) (Kubernetes): Throw traffic at a Horizontal Pod Autoscaler and watch replicas, CPU and dropped requests over time.
- [Load balancer](https://levelcode.org/labs/load-balancer) (Infrastructure): Compare balancing algorithms, health checks and consistent hashing under simulated load.
- [Rate limiter](https://levelcode.org/labs/rate-limiter) (System design): Run one stream of requests through fixed window, sliding log, sliding counter and token bucket limiters side by side.
- [Quorum reads and writes](https://levelcode.org/labs/quorum) (System design): Pick N, W and R, take replicas down, and see exactly when a read misses the latest write.
- [Bloom filter](https://levelcode.org/labs/bloom-filter) (System design): Add words to a bit array, check membership, and watch false positives appear as it fills.

## Software Engineer

The generalist path. Learn the data structures and algorithms every engineer is expected to know and build on both sides of the stack. Then learn to write code that survives change — clean code, SOLID, design patterns, test-driven development, modular and clean architecture, domain-driven design — and finish by preparing for the coding, system design and pair-programming interviews product companies run.

### Foundations

- [Learn to Code roadmap](https://levelcode.org/roadmaps/learn-to-code) (optional): Never written a program? Start here. Skip it if you can already write loops and functions.
- [Data structures](https://levelcode.org/roadmaps/software-engineer/data-structures): Arrays, hash maps, stacks, queues, trees, heaps and graphs — and what each operation costs.
- [Algorithms & complexity](https://levelcode.org/roadmaps/software-engineer/algorithms): Big-O, sorting, binary search, recursion, BFS/DFS and dynamic programming.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): Every change you make as an engineer goes through Git and a pull request.

### Build across the stack

- [Backend with Go roadmap](https://levelcode.org/roadmaps/go-backend): Design, build and ship HTTP services backed by PostgreSQL.
- [Frontend Developer roadmap](https://levelcode.org/roadmaps/frontend): The other half of every feature: the browser, TypeScript and React.

### Code that lasts

- [Clean code](https://levelcode.org/roadmaps/software-engineer/clean-code): Naming, small functions, guard clauses instead of arrow code, and comments that earn their place.
- [DRY, KISS, YAGNI & CQS](https://levelcode.org/roadmaps/software-engineer/design-principles): Coupling, cohesion and the rules of thumb that keep code simple.
- [SOLID principles](https://levelcode.org/roadmaps/software-engineer/solid): Five principles for code that bends instead of breaks, in Go and TypeScript.
- [Design patterns](https://levelcode.org/roadmaps/software-engineer/design-patterns): Strategy, adapter, decorator, observer, factory and options — and when not to use them.
- [Refactoring](https://levelcode.org/roadmaps/software-engineer/refactoring): Code smells, small safe steps and characterization tests.

### Testing & collaboration

- [Test-driven development](https://levelcode.org/roadmaps/software-engineer/tdd): Red, green, refactor — the test pyramid, and test doubles that don’t lie.
- [Pair programming](https://levelcode.org/roadmaps/software-engineer/pair-programming): Driver and navigator, ping-pong TDD, and pairing remotely.
- [Debugging](https://levelcode.org/roadmaps/software-engineer/debugging): Reproduce, isolate, hypothesise: a method for bugs you don’t understand yet.

### Architecture

- [Modular design](https://levelcode.org/roadmaps/software-engineer/modular-design): Package by feature, api/implementation splits and the modular monolith.
- [Clean & hexagonal architecture](https://levelcode.org/roadmaps/software-engineer/clean-architecture): The dependency rule, ports and adapters, and a Go service laid out that way.
- [Domain-driven design](https://levelcode.org/roadmaps/software-engineer/domain-driven-design): Ubiquitous language, bounded contexts, aggregates and value objects.
- [Design docs & ADRs](https://levelcode.org/roadmaps/software-engineer/design-docs) (optional): Write a decision down before you build it, and record why you made it.
- [System Design roadmap](https://levelcode.org/roadmaps/system-design): From one well-structured service to systems of them: scale, data, queues and failure.

### Get hired, then grow

- [Coding interviews](https://levelcode.org/roadmaps/software-engineer/coding-interviews): The patterns behind most problems, and how to solve out loud.
- [System design interviews](https://levelcode.org/roadmaps/software-engineer/system-design-interviews): A 45-minute structure and what interviewers actually score.
- [Pairing & take-home interviews](https://levelcode.org/roadmaps/software-engineer/pairing-interviews): Build a small, tested, extensible program under time pressure.
- [Behavioral interviews](https://levelcode.org/roadmaps/software-engineer/behavioral-interviews) (optional): Stories that show scope, ownership and judgment.
- [Growing to senior](https://levelcode.org/roadmaps/software-engineer/growing-to-senior) (optional): Scope, ownership, influence and the habits that get you promoted.

## Frontend Developer

Learn how browsers turn code into pixels, then build up through CSS layout, modern JavaScript, TypeScript and React (routing and forms included), finishing with server rendering, Next.js and the production skills that separate hobby projects from professional work.

### The web platform

- [How the web works](https://levelcode.org/roadmaps/frontend/how-the-web-works): DNS, HTTP, and what a browser does with a URL.
- [HTML essentials](https://levelcode.org/roadmaps/frontend/html-essentials): Semantic structure, forms, and the document outline.
- [CSS fundamentals](https://levelcode.org/roadmaps/frontend/css-fundamentals): Selectors, the cascade, specificity and the box model.
- [Flexbox & Grid](https://levelcode.org/roadmaps/frontend/css-layout): The two layout systems you will use every day.
- [Responsive design](https://levelcode.org/roadmaps/frontend/responsive-design): Fluid layouts, media queries and container queries.

### JavaScript

- [JavaScript basics](https://levelcode.org/roadmaps/frontend/javascript-basics): Values, functions, objects, arrays and scope.
- [The DOM & events](https://levelcode.org/roadmaps/frontend/dom-and-events): Reading and changing the page in response to users.
- [Async JavaScript](https://levelcode.org/roadmaps/frontend/async-javascript): The event loop, promises, async/await and fetch.
- [Modules & tooling](https://levelcode.org/roadmaps/frontend/modules-and-tooling): ES modules, npm, bundlers and Vite.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): Every team ships through Git. Learn it before your first real project.

### TypeScript & React

- [TypeScript essentials](https://levelcode.org/roadmaps/frontend/typescript-essentials): Types, interfaces, unions, generics and narrowing.
- [React fundamentals](https://levelcode.org/roadmaps/frontend/react-fundamentals): Components, JSX, props and rendering lists.
- Pick one — Style your components: Two mainstream ways to keep CSS manageable in a component codebase. Learn one well.
  - [Tailwind CSS](https://levelcode.org/roadmaps/frontend/tailwind-css): Utility-first styling, design tokens and variants.
  - [CSS Modules](https://levelcode.org/roadmaps/frontend/css-modules): Locally scoped class names in plain CSS files.
- [State & effects](https://levelcode.org/roadmaps/frontend/react-state-and-effects): useState, useEffect, and when you need neither.
- [Routing](https://levelcode.org/roadmaps/frontend/client-side-routing): URLs, nested layouts, params, loaders and code splitting.
- [Forms in React](https://levelcode.org/roadmaps/frontend/forms): Form actions, Zod validation, pending states and accessible errors.
- [Data fetching & caching](https://levelcode.org/roadmaps/frontend/data-fetching): Loading states, server state and TanStack Query.

### Production

- [SSR, SSG & meta-frameworks](https://levelcode.org/roadmaps/frontend/rendering-strategies): Server rendering, hydration and Next.js server components.
- [Accessibility](https://levelcode.org/roadmaps/frontend/accessibility): Semantics, keyboard support, ARIA and contrast.
- [Web performance](https://levelcode.org/roadmaps/frontend/web-performance): Core Web Vitals and how to actually improve them.
- [Testing the frontend](https://levelcode.org/roadmaps/frontend/testing-frontend) (optional): Unit, component and end-to-end tests.

## Backend with Go

Start with how servers talk to clients, learn Go from the ground up, then build real JSON APIs (and gRPC services) backed by PostgreSQL with background jobs — and finish with auth, web security, testing, observability, profiling and deployment.

### Foundations

- [How backends work](https://levelcode.org/roadmaps/go-backend/how-backends-work): Requests, responses, statelessness and status codes.
- [Go basics](https://levelcode.org/roadmaps/go-backend/go-basics): Packages, variables, control flow, slices and maps.
- [Structs, methods & interfaces](https://levelcode.org/roadmaps/go-backend/go-types-and-interfaces): Modelling data and behaviour the Go way.
- [Generics & iterators](https://levelcode.org/roadmaps/go-backend/go-generics): Constraints, slices and maps, and range-over-func iterators.
- [Error handling](https://levelcode.org/roadmaps/go-backend/go-errors): Errors as values, wrapping, errors.Is and errors.As.
- [Concurrency](https://levelcode.org/roadmaps/go-backend/go-concurrency): Goroutines, channels, select, sync and context.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): You will version, review and ship every service through Git.

### Building APIs

- [HTTP servers with net/http](https://levelcode.org/roadmaps/go-backend/net-http-servers): Handlers, ServeMux patterns and timeouts.
- [Routing & middleware](https://levelcode.org/roadmaps/go-backend/routing-and-middleware): Path parameters, composition and request context.
- [JSON & validation](https://levelcode.org/roadmaps/go-backend/json-and-validation): Encoding, decoding safely and validating input.
- [REST API design](https://levelcode.org/roadmaps/go-backend/rest-api-design): Resources, methods, pagination and error shapes.
- [gRPC services](https://levelcode.org/roadmaps/go-backend/grpc) (optional): Protocol Buffers, generated code, deadlines, status codes and streaming.

### Data

- [SQL databases in Go](https://levelcode.org/roadmaps/go-backend/sql-with-go): database/sql, pgx, connection pools and scanning.
- [Migrations & transactions](https://levelcode.org/roadmaps/go-backend/migrations-and-transactions): Evolving schemas and keeping data consistent.
- [Background jobs](https://levelcode.org/roadmaps/go-backend/background-jobs): A Postgres job queue with SKIP LOCKED, retries and idempotency.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql) (optional): Go deeper on queries, schema design, indexes and isolation.
- [Caching with Redis](https://levelcode.org/roadmaps/go-backend/caching) (optional): Cache-aside, TTLs and invalidation.

### Production

- [Authentication & authorization](https://levelcode.org/roadmaps/go-backend/auth): Password hashing, sessions vs tokens, RBAC.
- [Web security for Go APIs](https://levelcode.org/roadmaps/go-backend/web-security): CORS, CSRF, security headers, XSS and SSRF.
- [Testing in Go](https://levelcode.org/roadmaps/go-backend/testing-go): Table-driven tests, httptest and test doubles.
- [Observability](https://levelcode.org/roadmaps/go-backend/observability): Structured logging with slog, metrics and tracing.
- [Profiling & performance](https://levelcode.org/roadmaps/go-backend/profiling) (optional): Benchmarks, pprof, escape analysis and the execution tracer.
- [Deploying Go services](https://levelcode.org/roadmaps/go-backend/deploying-go): Config, graceful shutdown, Docker and health checks.
- [System Design roadmap](https://levelcode.org/roadmaps/system-design) (optional): One service works. Now design systems of them: scaling, data, queues and failure.

## Backend with Node.js

Learn how Node.js serves thousands of requests on one thread, set up TypeScript the modern way, and master files, streams and processes. Then build JSON APIs with Hono and Zod, back them with PostgreSQL, add secure sessions, test everything with Vitest, and ship a container that logs, checks its health and shuts down gracefully.

### Foundations

- [How Node.js works](https://levelcode.org/roadmaps/node-backend/node-runtime): The event loop, modules, npm and what Node is good at.
- [TypeScript on Node](https://levelcode.org/roadmaps/node-backend/node-typescript): Type stripping, tsconfig, type-checking and builds.
- [Files, streams & processes](https://levelcode.org/roadmaps/node-backend/node-core-apis): fs, streams and pipeline, AbortSignal and child processes.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): You will version, review and ship every service through Git.

### Building APIs

- [HTTP servers with Hono](https://levelcode.org/roadmaps/node-backend/http-servers-node): Routing, params, middleware and REST conventions.
- [Validation & error handling](https://levelcode.org/roadmaps/node-backend/validation-and-errors): Zod schemas, one error format and a central error handler.

### Data

- [PostgreSQL from Node](https://levelcode.org/roadmaps/node-backend/postgres-node): Pools, parameters, transactions, migrations and repositories.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql) (optional): Go deeper on queries, schema design, indexes and isolation.

### Production

- [Authentication & sessions](https://levelcode.org/roadmaps/node-backend/auth-node): Password hashing, session cookies, authorisation and CSRF.
- [Testing with Vitest](https://levelcode.org/roadmaps/node-backend/testing-node): Unit, route and database tests, fakes and CI.
- [Logging, config & deployment](https://levelcode.org/roadmaps/node-backend/deploying-node): pino, health checks, graceful shutdown and Docker.
- [System Design roadmap](https://levelcode.org/roadmaps/system-design) (optional): One service works. Now design systems of them: scaling, data, queues and failure.

## Full-Stack Developer

Learn both halves — the Frontend Developer and Backend with Node.js roadmaps — then the work that lives between them: a monorepo with shared schemas, a type-safe API client, sign-in that spans browser and server, file uploads, and shipping frontend and API together as one tested, cached, safely deployed product.

### Both halves

- [Frontend Developer roadmap](https://levelcode.org/roadmaps/frontend): HTML, CSS, JavaScript, TypeScript and React: everything users see.
- [Backend with Node.js roadmap](https://levelcode.org/roadmaps/node-backend): APIs, PostgreSQL, auth and deployment, in the same language as the frontend.

### Connect them

- [How a full-stack app fits together](https://levelcode.org/roadmaps/full-stack/full-stack-architecture): Monorepo, shared schemas, dev proxy and same-origin deploys.
- [Type-safe APIs end to end](https://levelcode.org/roadmaps/full-stack/type-safe-apis): Hono RPC, typed errors, TanStack Query and the alternatives.
- [Auth across the stack](https://levelcode.org/roadmaps/full-stack/auth-across-the-stack): Sessions in React, protected routes, 401 handling and social login.
- [File uploads](https://levelcode.org/roadmaps/full-stack/file-uploads) (optional): Through the API or straight to S3 with presigned URLs, safely.

### Ship it

- [Shipping a full-stack app](https://levelcode.org/roadmaps/full-stack/shipping-full-stack): One image, cache headers, migrations, CI and safe rolling deploys.
- [System Design roadmap](https://levelcode.org/roadmaps/system-design) (optional): When one service is no longer enough: scaling, data, queues and failure.

## AI Engineer

Understand what LLMs actually do, call them from code, and grow from single prompts to tool use, MCP, retrieval and agents with memory — then learn the evaluation, cost and security discipline that production AI features need.

### LLM foundations

- [Python roadmap](https://levelcode.org/roadmaps/python) (optional): Most AI tooling is Python-first, and the recommended route below uses it. Skip this if you already write Python comfortably.
- [How LLMs work](https://levelcode.org/roadmaps/ai-engineer/how-llms-work): Tokens, next-token prediction, context windows and model choice.
- Pick one — Call an LLM API from code: Same concepts, your language. Pick the one you build in.
  - [LLM APIs in Python](https://levelcode.org/roadmaps/ai-engineer/llm-apis-python): Messages, system prompts, streaming and errors.
  - [LLM APIs in TypeScript](https://levelcode.org/roadmaps/ai-engineer/llm-apis-typescript): The same, for Node and edge runtimes.
- [Prompt engineering](https://levelcode.org/roadmaps/ai-engineer/prompt-engineering): Clear instructions, examples, context and iteration.
- [Structured output](https://levelcode.org/roadmaps/ai-engineer/structured-output): Getting validated JSON out of a model, every time.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): Prompts, evals and agent code are code: version and review them like any other.

### Building with LLMs

- [Tool use](https://levelcode.org/roadmaps/ai-engineer/tool-use): Function calling and the request → tool → result loop.
- [Model Context Protocol](https://levelcode.org/roadmaps/ai-engineer/mcp): Build and connect MCP servers, and secure what they expose.
- [Embeddings](https://levelcode.org/roadmaps/ai-engineer/embeddings): Turning text into vectors and measuring similarity.
- [Vector search](https://levelcode.org/roadmaps/ai-engineer/vector-databases): pgvector, ANN indexes and metadata filtering.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql) (optional): pgvector lives in PostgreSQL. Solid SQL makes retrieval far easier.
- [Retrieval-augmented generation](https://levelcode.org/roadmaps/ai-engineer/rag): Chunking, retrieval, reranking and grounded answers.

### Agents & production

- [Agents](https://levelcode.org/roadmaps/ai-engineer/agents): Agent loops, planning, and when not to build one.
- [Context & memory](https://levelcode.org/roadmaps/ai-engineer/context-engineering): Budgeting the window, compaction, sub-agents and long-term memory.
- [Evaluations](https://levelcode.org/roadmaps/ai-engineer/evals): Test sets, graders and catching regressions.
- [Cost & latency](https://levelcode.org/roadmaps/ai-engineer/cost-and-latency): Prompt caching, batching, model routing and streaming UX.
- [Security for AI apps](https://levelcode.org/roadmaps/ai-engineer/ai-security): Prompt injection, data leakage and safe output handling.
- Pick one — Serve models in production: Most teams start on hosted APIs; some need to run open models themselves.
  - [Hosted APIs in production](https://levelcode.org/roadmaps/ai-engineer/production-llm-apps): Rate limits, retries, fallbacks and observability.
  - [Self-hosting open models](https://levelcode.org/roadmaps/ai-engineer/self-hosting-models): Ollama, vLLM, quantization and GPU sizing.

## DevSecOps Engineer

Learn the systems and networking basics security work rests on, then secure the pipeline end to end: threat modeling, secure code, secrets, CI scanning and the software supply chain. Then learn how production runs — infrastructure as code, containers, Kubernetes, load balancers, autoscaling and API gateways — and how to harden, observe, recover and prove compliance for it.

### Foundations

- [DevSecOps fundamentals](https://levelcode.org/roadmaps/devsecops/devsecops-fundamentals): Shift-left, shared ownership and the secure SDLC.
- [Linux essentials](https://levelcode.org/roadmaps/devsecops/linux-essentials): The shell, users, permissions, processes and services.
- [Networking essentials](https://levelcode.org/roadmaps/devsecops/networking-essentials): TCP/IP, DNS, TLS, ports and firewalls.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git): Pipelines, reviews and audit trails all start in Git.

### Secure the code

- [Threat modeling](https://levelcode.org/roadmaps/devsecops/threat-modeling): Data-flow diagrams, STRIDE and prioritising risk.
- [Secure coding & the OWASP Top 10](https://levelcode.org/roadmaps/devsecops/secure-coding): The vulnerability classes that matter most, with fixes.
- [Secrets management](https://levelcode.org/roadmaps/devsecops/secrets-management): Keeping credentials out of code, and rotating them.

### Secure the pipeline

- Pick one — Pick a CI/CD platform: The concepts transfer; learn the one your team uses.
  - [GitHub Actions](https://levelcode.org/roadmaps/devsecops/ci-github-actions): Workflows, runners, permissions and OIDC.
  - [GitLab CI/CD](https://levelcode.org/roadmaps/devsecops/ci-gitlab): Pipelines, stages, runners and protected variables.
- [SAST & dependency scanning](https://levelcode.org/roadmaps/devsecops/sast-and-sca): Static analysis, SCA, SBOMs and triaging findings.
- [Software supply chain security](https://levelcode.org/roadmaps/devsecops/supply-chain-security): Pinning, provenance, SLSA and signing artifacts.
- [Dynamic testing (DAST)](https://levelcode.org/roadmaps/devsecops/dast): Scanning running apps and fitting it into CI.

### Run the platform

- [Infrastructure as code with Terraform](https://levelcode.org/roadmaps/devsecops/terraform): Resources, state, modules, environments and CI applies.
- [Containers & container security](https://levelcode.org/roadmaps/devsecops/container-security): Minimal images, non-root, scanning and runtime limits.
- [Kubernetes fundamentals](https://levelcode.org/roadmaps/devsecops/kubernetes-fundamentals): Pods, Deployments, Services, Ingress, config and kubectl.
- [Load balancing](https://levelcode.org/roadmaps/devsecops/load-balancing): L4 vs L7, algorithms, health checks and TLS termination.
- [Autoscaling](https://levelcode.org/roadmaps/devsecops/autoscaling): HPA, cluster autoscaling, scaling signals and cost limits.
- [API gateways](https://levelcode.org/roadmaps/devsecops/api-gateways): Routing, authentication, rate limiting and the Gateway API.
- [Service mesh & mTLS](https://levelcode.org/roadmaps/devsecops/service-mesh) (optional): Zero-trust service-to-service traffic with mutual TLS.

### Secure the platform

- [Kubernetes security](https://levelcode.org/roadmaps/devsecops/kubernetes-security): RBAC, Pod Security Standards and network policies.
- [Infrastructure as code security](https://levelcode.org/roadmaps/devsecops/iac-security): Terraform, policy as code and IaC scanning.
- [Cloud identity & access](https://levelcode.org/roadmaps/devsecops/cloud-iam): Least privilege, roles, short-lived credentials.
- [Edge protection: WAF & DDoS](https://levelcode.org/roadmaps/devsecops/waf-and-ddos): Web application firewalls, rate limits and DDoS defence.

### Operate & recover

- [Monitoring & incident response](https://levelcode.org/roadmaps/devsecops/incident-response): Security logging, alerting and handling an incident.
- [Backup & disaster recovery](https://levelcode.org/roadmaps/devsecops/backup-and-recovery): RPO/RTO, immutable backups, restore drills and ransomware.
- [Compliance: SOC 2 & ISO 27001](https://levelcode.org/roadmaps/devsecops/compliance): Frameworks, audits, controls as code and automated evidence.

## Learn to Code

For complete beginners. Learn to use the command line, then the building blocks every language shares — variables, decisions, loops, functions, lists and dictionaries — taught in Python. Finish by reading and writing files, debugging with a method, and building a complete program on your own.

### Getting started

- [The command line](https://levelcode.org/roadmaps/learn-to-code/command-line): Folders, paths and the dozen commands you use every day.
- [Your first program](https://levelcode.org/roadmaps/learn-to-code/first-program): What code is, installing Python, and running a program.

### The building blocks

- [Values, variables & types](https://levelcode.org/roadmaps/learn-to-code/values-and-variables): Numbers, text, booleans, conversions and f-strings.
- [Decisions & loops](https://levelcode.org/roadmaps/learn-to-code/conditions-and-loops): if, elif, else, while, for, break and continue.
- [Functions](https://levelcode.org/roadmaps/learn-to-code/functions): Parameters, return values, scope and breaking problems down.
- [Lists & dictionaries](https://levelcode.org/roadmaps/learn-to-code/lists-and-dicts): Collections, looping over them, and modelling real data.

### Writing real programs

- [Errors & debugging](https://levelcode.org/roadmaps/learn-to-code/errors-and-debugging): Tracebacks, try and except, and a method for finding bugs.
- [Files & modules](https://levelcode.org/roadmaps/learn-to-code/files-and-modules): Text, CSV and JSON files, the standard library and your own modules.
- [Your first project](https://levelcode.org/roadmaps/learn-to-code/first-project): Plan and build a complete command-line app, step by step.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git) (optional): Save every step of your work and share it. The natural next step after your first project.

## Python

Go from writing Python to writing it well. Set up real projects with uv, write idiomatic, typed code with classes and dataclasses, master iterators, exceptions and context managers, and test everything with pytest. Then build things: reliable HTTP clients, concurrent programs with asyncio, and JSON APIs with FastAPI.

### Foundations

- [Learn to Code roadmap](https://levelcode.org/roadmaps/learn-to-code) (optional): New to programming? Learn the basics in Python first. Skip it if you can already write functions, loops and dictionaries.
- [Projects & environments](https://levelcode.org/roadmaps/python/python-projects): Virtual environments, uv, pyproject.toml, lock files and Ruff.
- [Idiomatic Python](https://levelcode.org/roadmaps/python/idiomatic-python): Unpacking, comprehensions, truthiness, EAFP and match.
- [Classes & dataclasses](https://levelcode.org/roadmaps/python/classes-and-dataclasses): Methods, special methods, properties, dataclasses and enums.
- [Type hints](https://levelcode.org/roadmaps/python/type-hints): Annotations, mypy, generics, TypedDict and Protocol.

### Core language

- [Iterators & generators](https://levelcode.org/roadmaps/python/iterators-and-generators): The iteration protocol, yield, lazy pipelines and itertools.
- [Exceptions & context managers](https://levelcode.org/roadmaps/python/exceptions-and-context-managers): Custom exceptions, chaining, groups and reliable cleanup.
- [Testing with pytest](https://levelcode.org/roadmaps/python/testing-python): Asserts, parametrize, fixtures, fakes, mocks and coverage.
- [Git & Collaboration roadmap](https://levelcode.org/roadmaps/git) (optional): Version every project you build from here on.

### Building things

- [Calling HTTP APIs](https://levelcode.org/roadmaps/python/http-apis-python): httpx, timeouts, retries, pagination, Pydantic and offline tests.
- [Async Python](https://levelcode.org/roadmaps/python/async-python): Coroutines, TaskGroup, timeouts, semaphores and blocking calls.
- [Web APIs with FastAPI](https://levelcode.org/roadmaps/python/fastapi): Routes, models, errors, dependencies and testing.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql) (optional): Real APIs store data in a database. Learn PostgreSQL next.

## SQL & Databases

Go from your first SELECT to window functions, then learn to design schemas that stay correct and fast — indexes, query plans and transactions included. Examples use PostgreSQL.

### Querying

- [The relational model](https://levelcode.org/roadmaps/sql/relational-model): Tables, rows, keys and why relational won.
- [SELECT basics](https://levelcode.org/roadmaps/sql/select-basics): Columns, expressions, aliases and LIMIT.
- [Filtering & sorting](https://levelcode.org/roadmaps/sql/filtering-and-sorting): WHERE, NULL semantics, ORDER BY.
- [Joins](https://levelcode.org/roadmaps/sql/joins): Inner, outer, self and cross joins, visually.
- [Aggregation](https://levelcode.org/roadmaps/sql/aggregation): GROUP BY, HAVING and aggregate functions.

### Advanced SQL

- [Subqueries & CTEs](https://levelcode.org/roadmaps/sql/subqueries-and-ctes): Nesting queries and naming intermediate results.
- [Window functions](https://levelcode.org/roadmaps/sql/window-functions): Rankings, running totals and moving averages.
- [Modifying data](https://levelcode.org/roadmaps/sql/modifying-data): INSERT, UPDATE, DELETE, upserts and RETURNING.

### Design & performance

- [Schema design & normalization](https://levelcode.org/roadmaps/sql/schema-design): Modelling entities and relationships.
- [Constraints & data integrity](https://levelcode.org/roadmaps/sql/constraints): Primary, foreign, unique and check constraints.
- [Indexes](https://levelcode.org/roadmaps/sql/indexes): B-trees, composite indexes and when not to index.
- [Reading query plans](https://levelcode.org/roadmaps/sql/query-plans): EXPLAIN ANALYZE and finding slow spots.
- [Transactions & isolation](https://levelcode.org/roadmaps/sql/transactions): ACID, isolation levels and locking.

## System Design

Learn to turn a vague problem into numbers, then the building blocks every large system is made of — caches, replicas, shards, queues, rate limiters and consensus — and the failure modes each one brings. Finish by designing four real systems end to end. Every building block also has its own short page in the Concepts library.

### Foundations

- [How to approach a design](https://levelcode.org/roadmaps/system-design/approach-a-design): Requirements, numbers, API and data first — then the boxes.
- [Back-of-the-envelope estimation](https://levelcode.org/roadmaps/system-design/estimation): QPS, storage, bandwidth and memory from a handful of numbers.
- [Scaling a service](https://levelcode.org/roadmaps/system-design/scaling-a-service): From one server to many: stateless tiers, replicas and CDNs.

### Data at scale

- [Caching strategies](https://levelcode.org/roadmaps/system-design/caching-strategies): Where caches go, how they stay correct and how they fail.
- [Replication](https://levelcode.org/roadmaps/system-design/replication): Leaders, followers, lag, failover and quorums.
- [Partitioning & sharding](https://levelcode.org/roadmaps/system-design/partitioning): Splitting data across machines without creating hot spots.
- [Consistency & CAP](https://levelcode.org/roadmaps/system-design/consistency-models): What "consistent" means, and what a partition forces you to give up.
- [Choosing a datastore](https://levelcode.org/roadmaps/system-design/choosing-a-datastore): Relational, key-value, document, wide-column, search and blobs.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql) (optional): Indexes, transactions and isolation are where most data designs succeed or fail.

### Communication & reliability

- [Queues & event streams](https://levelcode.org/roadmaps/system-design/queues-and-streams): Async work, delivery guarantees, ordering and the outbox.
- [Rate limiting](https://levelcode.org/roadmaps/system-design/rate-limiting): Token buckets, sliding windows and limits across many servers.
- [Designing for failure](https://levelcode.org/roadmaps/system-design/designing-for-failure): Timeouts, retries, circuit breakers, bulkheads and load shedding.
- [IDs, clocks & consensus](https://levelcode.org/roadmaps/system-design/coordination): Unique IDs, event ordering, leader election, leases and Raft.

### Case studies

- [Design a URL shortener](https://levelcode.org/roadmaps/system-design/design-url-shortener): Key generation, redirects at 100k QPS, caching and analytics.
- [Design a news feed](https://levelcode.org/roadmaps/system-design/design-news-feed): Fan-out on write or read, celebrities, ranking and caching.
- [Design a chat system](https://levelcode.org/roadmaps/system-design/design-chat-system): WebSockets, ordering, delivery receipts, presence and push.
- [Design a payment system](https://levelcode.org/roadmaps/system-design/design-payment-system): Idempotency, double-entry ledgers, PSPs and reconciliation.
- [Design search autocomplete](https://levelcode.org/roadmaps/system-design/design-typeahead) (optional): Tries with top-k, an offline pipeline, CDN caching and filtering.
- [Design a notification system](https://levelcode.org/roadmaps/system-design/design-notification-system) (optional): Channels, preferences, priorities, retries and provider failover.
- [Design a file sync service](https://levelcode.org/roadmaps/system-design/design-file-sync) (optional): Chunking, deduplication, a metadata journal and conflicts.
- [Design video streaming](https://levelcode.org/roadmaps/system-design/design-video-streaming) (optional): Transcoding, adaptive bitrate, CDNs and view counting.
- [Design a web crawler](https://levelcode.org/roadmaps/system-design/design-web-crawler) (optional): The URL frontier, politeness, duplicates and recrawl scheduling.

## Rust

Learn Rust from the ground up: Cargo, ownership and borrowing, enums and pattern matching, errors as values, traits, generics and lifetimes. Then put it to work on systems problems — smart pointers, threads, async with Tokio — and finish by shipping a JSON web service with Axum. Examples target Rust 1.85+ and the 2024 edition.

### Foundations

- [Getting started](https://levelcode.org/roadmaps/rust/getting-started): rustup, Cargo, your first program and reading compiler errors.
- [Rust basics](https://levelcode.org/roadmaps/rust/rust-basics): Variables, mutability, types, functions, control flow and expressions.
- [Ownership](https://levelcode.org/roadmaps/rust/ownership): Moves, copies, clones and drop — how Rust frees memory without a GC.
- [References & borrowing](https://levelcode.org/roadmaps/rust/borrowing): Shared and mutable references, slices, and String vs &str.
- [Structs, enums & pattern matching](https://levelcode.org/roadmaps/rust/structs-and-enums): Modelling data, methods, Option and exhaustive match.

### Core language

- [Error handling](https://levelcode.org/roadmaps/rust/error-handling): Result, the ? operator, custom error types, thiserror and anyhow.
- [Collections, closures & iterators](https://levelcode.org/roadmaps/rust/collections-and-iterators): Vec, HashMap, closures and iterator chains that compile to loops.
- [Traits & generics](https://levelcode.org/roadmaps/rust/traits-and-generics): Shared behaviour, trait bounds, impl Trait and dyn Trait.
- [Lifetimes](https://levelcode.org/roadmaps/rust/lifetimes): What lifetime annotations say, the elision rules and structs that borrow.
- [Modules, crates & Cargo](https://levelcode.org/roadmaps/rust/modules-and-cargo): Visibility, workspaces, dependencies and feature flags.
- [Testing & tooling](https://levelcode.org/roadmaps/rust/testing-rust): Unit, integration and doc tests, plus clippy and rustfmt.

### Systems & production

- [Smart pointers](https://levelcode.org/roadmaps/rust/smart-pointers): Box, Rc, Arc, RefCell and Mutex — and when you need each.
- [Fearless concurrency](https://levelcode.org/roadmaps/rust/concurrency): Threads, scoped threads, channels, Mutex and Send/Sync.
- [Async Rust](https://levelcode.org/roadmaps/rust/async-rust): Futures, async/await, Tokio, spawning tasks and select!.
- [Web services with Axum](https://levelcode.org/roadmaps/rust/web-services-axum): A JSON API with Axum and Serde: state, errors and graceful shutdown.
- [SQL & Databases roadmap](https://levelcode.org/roadmaps/sql) (optional): Most services you build in Rust will sit on PostgreSQL.
- [Unsafe Rust & FFI](https://levelcode.org/roadmaps/rust/unsafe-and-ffi) (optional): What unsafe unlocks, sound abstractions and calling C.

## Git & Collaboration

Build a correct mental model of commits, branches and remotes, then learn the day-to-day workflows teams use to collaborate through pull requests without fear.

### Core concepts

- [How Git works](https://levelcode.org/roadmaps/git/how-git-works): Snapshots, the object store and the three areas.
- [Your first repository](https://levelcode.org/roadmaps/git/first-repository): init, status, add, commit, log and diff.
- [Branching & merging](https://levelcode.org/roadmaps/git/branching-and-merging): Cheap branches, fast-forwards and merge commits.
- [Remotes & GitHub](https://levelcode.org/roadmaps/git/remotes): clone, fetch, pull, push and tracking branches.

### Everyday workflow

- [Undoing changes](https://levelcode.org/roadmaps/git/undoing-changes): restore, reset, revert — and when to use which.
- [Resolving conflicts](https://levelcode.org/roadmaps/git/merge-conflicts): Why conflicts happen and how to fix them calmly.
- [Rebasing](https://levelcode.org/roadmaps/git/rebase): Linear history, interactive rebase and the golden rule.
- [Pull requests & code review](https://levelcode.org/roadmaps/git/pull-requests): Writing good PRs and reviewing others.

### Going further

- [Team workflows](https://levelcode.org/roadmaps/git/workflows): Trunk-based, GitHub flow and commit conventions.
- [Power tools](https://levelcode.org/roadmaps/git/power-tools) (optional): stash, bisect, reflog, cherry-pick and hooks.