Authentication vs. authorization
Authentication proves who a user is. Authorization decides what that user may see or do. A login can succeed while authorization still blocks data—or exposes too much.
API and webhook
An API request asks another system for work now. A webhook is an event delivered later, often after a payment, signup, or email event. Webhooks must be verified and safe to receive more than once.
CORS
Cross-Origin Resource Sharing is a browser rule controlling which websites may call an API. A CORS error is often an architecture or server-response problem, not something to bypass in the browser.
Environment variable
A named configuration value supplied outside the code. Some values are public configuration; others are secrets and must never be included in browser bundles or intake forms.
RLS
Row-level security is a database rule that decides which records a user can read or change. Client-side filtering is not a replacement for a real data-access rule.
Regression
A previously working behavior that breaks after a change. A regression test protects the repaired path from being silently undone by later edits.
Technical debt
A deliberate or accidental shortcut that makes later changes harder or riskier. Not all debt requires immediate cleanup; the dangerous debt is prioritized first.
Source of truth
The canonical place where a value, rule, component, or configuration is owned. Generated projects often fail because multiple copies compete.