senior-backend_skill

Overview

This skill designs and implements robust backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. It provides practical tooling and workflows for Express/Fastify/Koa, PostgreSQL optimization, API load testing, and secure production readiness. Use it to speed development, reduce runtime risk, and improve performance and security.

How this skill works

I generate API scaffolding from OpenAPI or database schemas, produce validation middleware and types, analyze database schemas to suggest migrations and indexes, and run configurable HTTP load tests to surface latency and error patterns. I also provide concrete security hardening steps—JWT configuration, rate limiting, input validation, and security headers—and automated reports you can act on.

When to use it

• Design or refactor REST or GraphQL endpoints
• Create route scaffolding and validation from OpenAPI
• Optimize slow PostgreSQL queries and generate index migrations
• Implement or review authentication and authorization flows
• Harden APIs before production or after a security review
• Load test endpoints to measure latency, throughput, and rate-limit behavior

Best practices

• Start from a clear OpenAPI contract and generate routes to keep API and docs in sync
• Run schema analysis before creating migrations; dry-run migrations in staging
• Prefer short-lived JWTs and asymmetric signing (RS256) for production tokens
• Add rate limiting and security headers (helmet) early in the stack
• Use targeted indexes, EXPLAIN ANALYZE, and test queries with representative data
• Load test with realistic concurrency and headers to validate throttling and error handling

Example use cases

• Auto-generate Express route handlers and validation from openapi.yaml, then implement business logic
• Analyze production DB, get missing indexes and N+1 risks, generate migration files with rollback support
• Run a 60s concurrency test to measure P50/P95/P99 and get scaling recommendations
• Review backend code and auth config, fix JWT secrets usage and adjust token lifetimes
• Set up rate limiting and helmet-based security headers and validate with attack-pattern load tests