Guides

These guides cover what you need after you have a working app. They are independent of each other — read whichever ones apply to your situation.

Before you ship

Production Readiness Preflight checks and release gates for security, storage, runtime reliability, and feature readiness.

Security CORS, CSRF, rate limits, helmet, content security policy, and secrets rotation.

Testing Unit, integration, entity route, and plugin testing patterns.

Error Handling Structured errors, error boundaries, and consistent error responses.

Multi-Tenancy Tenant resolution, scoped data, isolation strategies, and cross-tenant operations.

Permissions RBAC, grants, evaluators, and resource-level access control.

Deployment Docker, serverless, managed hosting, and environment configuration.

Runtime Bun, Node, and edge runtimes — what each supports and when to switch.

Horizontal Scaling Stateless workers, external event buses, session stores, and WebSocket scaling.

Secrets Secret providers, rotation, and environment-specific resolution.

Observability Structured logging, OpenTelemetry tracing, and metrics export.

Monitoring Health checks, readiness probes, and operational dashboards.

OpenAPI Generated API docs, typed routes, schema registration, and versioned specs.

Uploads File upload handling, storage backends, and size limits.

WebSockets Advanced WebSocket patterns — rooms, pub/sub, scaling, and auth.

Webhooks Webhook delivery, retry policies, payload signing, and endpoint management.

Transactional Mail Provider-backed templated email delivery and queue behavior.

Webhooks Outbound endpoint management and inbound webhook intake.

Admin Surface Admin routes, managed users, permissions, and audit logging.

Content Model Structuring content entities, rich text, versioning, and publishing workflows.

Migrate Community Plugin Upgrade guide for the slingshot-community config rewrite.

When something is not working: