In the previous tutorial, we learned to work with GitHub and set up CI/CD. Now it is time for the advanced tools. Every developer makes mistakes. You commit the wrong file. You break something and need to find out which commit caused it. You need to grab a single commit from another branch. Git has tools for all of this. In this tutorial, you will learn to undo mistakes, recover lost work, and use power features that save hours of debugging. ...

In the previous tutorial, we learned to merge and rebase branches. But everything happened on your local computer. Real projects involve multiple people working together. This is where GitHub comes in. GitHub is a platform that hosts Git repositories online. It lets you share code, review changes, and automate testing. In this tutorial, you will learn to push code to GitHub, create pull requests, and set up basic CI/CD with GitHub Actions. ...

In the previous tutorial, we learned to create branches and work on them. But branches are only useful if you can bring the work back together. Git gives you two ways to combine branches: merge and rebase. In this tutorial, you will learn both, understand the difference, and know when to use each one. We will also cover merge conflicts and git stash. What Is Merging? Merging takes two branches and combines them. You switch to the branch you want to update, then merge the other branch into it. ...

In the previous tutorial, we learned to create a repository, stage files, and make commits. All our work happened on one branch — main. But what if you want to add a new feature without breaking your working code? What if two people need to work on different things at the same time? This is why branches exist. A branch is a separate line of development. You can make changes on a branch without affecting other branches. When you are done, you merge the changes back. ...

Every developer uses Git. It does not matter if you write Python, JavaScript, Rust, or Kotlin. Git tracks your code changes, lets you go back to any previous version, and helps you work with other developers. In this tutorial, you will install Git, create your first repository, and make your first commit. By the end, you will understand how Git tracks changes. What Is Git? Git is a version control system. It saves snapshots of your project over time. Each snapshot is called a commit. ...

You have built a complete Ktor backend with authentication, database, WebSockets, Docker, and CI/CD. Now it is time to connect everything — a Kotlin backend and a Kotlin client sharing the same data models. In this final tutorial, you will create shared data models, build a Ktor Client that consumes your API, and see how a KMP mobile app connects to your backend. The Full-Stack Kotlin Vision Most full-stack projects look like this: ...

Your API has many endpoints. Other developers need to know how to use them. They need to know the request format, response format, required headers, and possible error codes. Writing documentation by hand is tedious and quickly becomes outdated. In this tutorial, you will add OpenAPI documentation and Swagger UI to your Ktor API. Developers can browse your API at /docs and try out endpoints directly from the browser. What is OpenAPI? OpenAPI (formerly Swagger) is a standard format for describing REST APIs. It is a YAML or JSON file that lists all endpoints, request bodies, response schemas, authentication, and more. ...

Your API has registration and login with email and password. But many users prefer to sign in with their Google account. It is faster and they do not need to remember another password. In this tutorial, you will add Google Sign-In using OAuth 2.0. You will learn how the OAuth flow works, how to handle the callback, and how to link OAuth accounts with existing email accounts. How OAuth 2.0 Works OAuth 2.0 is a protocol that lets users sign in with a third-party provider (Google, GitHub, etc.) without sharing their password with your application. ...

You decided to build a backend with Kotlin. Good choice. But now you face another decision: Ktor or Spring Boot? Both are great frameworks. Both support Kotlin. But they are very different in philosophy, design, and use cases. Let’s compare them honestly. The Big Picture Ktor is a lightweight, modular framework built by JetBrains. It is Kotlin-native, coroutine-based, and you add features as plugins. Spring Boot is a full-featured, batteries-included framework from VMware (now Broadcom). It started as a Java framework and added Kotlin support later. ...

This is the final article in the Security for Developers series. It brings everything together into a single, actionable checklist you can use for every project. Bookmark this page and review it whenever you start a new project or prepare for a security review. How to Use This Checklist Each item is marked with a priority level: P0 (Critical): Do this before going to production. Skipping it means you are vulnerable. P1 (High): Do this within the first week of production. Important for security posture. P2 (Medium): Do this within the first month. Improves defense in depth. P3 (Low): Nice to have. Do when you have time. Authentication Checklist # Item Priority Details 1 Hash passwords with bcrypt or Argon2 P0 Never store plaintext. Use cost factor 12+ for bcrypt. 2 Enforce minimum password length of 8 characters P0 NIST recommends 8+ characters. Do not require special characters. 3 Use HTTPS for all authentication endpoints P0 Credentials in transit must be encrypted. 4 Implement account lockout after failed attempts P1 Lock after 5-10 failed attempts for 15-30 minutes. 5 Use JWT with short expiration (15-60 min) P1 Combine with refresh tokens for longer sessions. 6 Sign JWTs with RS256 or EdDSA (not HS256 for distributed) P1 Asymmetric signing prevents key sharing. 7 Store tokens in httpOnly cookies (not localStorage) P1 Prevents XSS from stealing tokens. 8 Implement refresh token rotation P1 Invalidate old refresh token on each use. 9 Validate JWT signature and expiration on every request P0 Never trust a token without validation. 10 Support multi-factor authentication (MFA) P2 TOTP or WebAuthn. SMS is better than nothing. 11 Check passwords against breached lists (Have I Been Pwned) P2 Reject passwords that appear in known breaches. 12 Log all authentication events P1 Successful and failed logins, password changes. Reference: Tutorial #2: Authentication ...