The stack

HTML, CSS, JavaScript — the three languages of the browser

Every web page, no matter how fancy, eventually becomes three things in the browser:

HTML — the structure

The skeleton of the page. Tags like <header>, <article>, <p>, <button> describe what the content is. HTML carries semantics: this is a heading, this is a list, this is a navigation block.

CSS — the styling

What it looks like. Color, layout, spacing, typography, animation. CSS is rule-based: "every paragraph inside a card has a 16px font and 1.6 line-height."

JavaScript — the behavior

What it does. Reactivity. Network calls. Animation logic. Form validation. Anything dynamic. JavaScript is the only programming language that runs in the browser.

Frameworks like React don't replace these — they sit on top of them. React generates HTML and uses JavaScript to update it; Tailwind generates CSS. The substrate is always HTML/CSS/JS.

The frontend framework landscape

You don't write React from scratch every time. You don't write CSS from scratch every time. You pick a framework that does most of the wiring and concentrate on the parts unique to your app.

The backend — runtimes and languages

The frontend has one runtime (the browser) and one language (JavaScript). The backend is wide-open. Common choices:

Node.js (JavaScript on the server)

The default for most modern web apps. Same language as your frontend. Huge ecosystem (npm). Runs on virtually every host.

Python (FastAPI, Django, Flask)

The default for AI/ML adjacent work, data pipelines, scripts. Excellent libraries. Slightly worse cold-start performance than Node.

Go

Compiled, fast, great concurrency. Used at Google, Cloudflare, Docker. Fewer libraries, simpler language.

Ruby (Rails)

Productive, opinionated, a bit retro. Still common at companies founded in the 2010s.

Bun, Deno

Newer JavaScript runtimes that fix Node's older sins. Faster, more secure, more batteries-included. Worth knowing about; not yet defaults.

For a solo founder or small team in 2025, Node.js plus a TypeScript-first framework (Next.js, Hono, FastAPI if you prefer Python) is the safest default by a wide margin. The agent has seen the most code.

APIs — REST and GraphQL

The frontend talks to the backend over an API (Application Programming Interface). The API is a contract: "if you send me X, I'll give you Y." Two main flavors:

HTTPCopy
GET    /api/tasks         → list all tasks
GET    /api/tasks/abc123  → get one task
POST   /api/tasks         → create a task
PUT    /api/tasks/abc123  → replace a task
PATCH  /api/tasks/abc123  → update a task
DELETE /api/tasks/abc123  → delete a task

Response body is JSON.

GRAPHQLCopy
query {
  tasks(workspace: "ws_123") {
    id
    title
    status
    assignee {
      name
      email
    }
  }
}

Databases — where the data lives

Behind the API. Never directly accessed by the browser. Two broad categories:

Postgres is the default — and what an ORM is

For 90% of new projects in 2025, the right answer is Postgres, hosted somewhere managed (Neon, Supabase, Render). Battle-tested, cheap to start, scales much further than you'll need.

You probably won't write raw SQL all the time. An ORM (Object-Relational Mapper) lets you query the database using your language's objects:

TSCopy
// raw SQL
const tasks = await db.query("SELECT * FROM tasks WHERE status = 'todo'");

// Prisma (an ORM)
const tasks = await prisma.task.findMany({ where: { status: 'todo' } });

Same query, different ergonomics. ORMs (Prisma, Drizzle, SQLAlchemy, ActiveRecord) save time, hide cost — they can quietly generate slow queries. Most teams use one anyway.

Auth — proving who you are

Auth is short for two related things:

Authentication (authn)

Proving who you are. The login flow. Passwords, magic links, social login.

Authorization (authz)

What you're allowed to do once you're in. Permissions, roles, ownership.

The patterns you'll meet:

Environment variables and secrets

Two categories of configuration any app has:

Public config

API base URLs, feature flags, the app's name. Usually fine to be visible in the frontend bundle.

Secrets

Database passwords, API keys, signing keys. Catastrophic if leaked. Must never appear in client-side code, in commits, or in screenshots.

Both live in environment variables — values the code reads at runtime that vary by environment. Locally they live in a .env file (git-ignored); in production they're entered into the deployment platform's UI or CLI.

ENVCopy
# .env.local — your laptop only, never committed
DATABASE_URL="postgres://user:pass@localhost/tasklane_dev"
AUTH_SECRET="dev-secret-not-for-prod"
RESEND_API_KEY="re_dev_..."
# All of these are different in staging and prod.

Wrap-up