📖 Glossary

Every technical word in this course, in plain English, defined the way the lessons use it, each with the lesson that teaches it best. Search this page with Ctrl+F (Mac: Cmd+F), and if a word you need isn't here, ask Claude Code to explain it in one sentence, then check its answer against a lesson.

Jump to: A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · R · S · T · U · V · W · Y

A

A record (and TTL)

An A record is one line in your domain's DNS that points a name at an IP address, like myapp → YOUR_VPS_IP. Its TTL (time to live) is how many seconds other computers may remember the answer; 300 is five minutes. Saved is not the same as live: it can take minutes for the rest of the internet to see a new record.

Learn it in Your own server.

Agent (and subagent)

An AI that acts instead of only answering: it reads your files, edits them and runs commands. Claude Code is one. A subagent is a helper Claude that a session starts for one slice of work, like researching one topic, in parallel with others; each starts blank and hands back a report.

Learn it in Work with Claude Code.

API (and endpoint)

A web address that returns data for programs, usually as JSON, instead of a page for people. A weather service answering "what's the forecast here?" is the usual example: your page or server sends it a request and reads the answer. Each address it answers is an endpoint (or route), like /api/summary; in web push, it is the long, unguessable URL that wakes one subscribed browser.

Learn it in How the web actually works.

API key

A code a service gives you to identify your app. Treat it as a secret and keep it in an env file on the server, unless the provider says it is meant to be public, as some map-tile keys are. Where your app only reads, ask for a read-only key, and if a key leaks, rotate it: make a new one, switch your app to it and revoke the old one, so the leaked copy stops working.

Learn it in Add a backend only when forced.

App (and the fleet)

In this course, a website that does something useful, opened in a browser. It can start as one HTML file and later become a PWA on a phone's home screen. The fleet is my word for the live apps I run at traqqit.com; every example in the course comes from one of them.

Learn it in How the web actually works.

App Bundle (APK and API level)

The two packagings of an Android app: the App Bundle (.aab) is what you upload to Google Play, and an APK (.apk) installs directly on your phone for testing. Play also checks the API level your app targets, Android's version number for developers (Android 16 is level 36), and an upload goes through testing tracks: internal testing, closed testing, then production.

Learn it in Ship to Google Play.

ArcGIS REST service

ArcGIS is mapping software many governments use, and its REST service is the public address behind their maps. Each layer (parcels, ZIP codes) answers questions with data, so a county's free layer can power a whole app; a parcel is one piece of land with its own tax record.

Learn it in Find an idea the data can carry.

Assertion (and self-check)

A line of code that says "this must be true" and stops the program, loudly, if it isn't. A self-check is a file's worth of them that runs in about a second, so a later edit can't quietly bring an old bug back.

Learn it in Check the AI's work.

B

Backend

A program on your server that answers requests itself, usually at addresses like /api/..., instead of handing over a file. You need one only for what a visitor must not control: a secret key, data shared between people, or a limit people can't cheat.

Learn it in Add a backend only when forced.

Backup (restic, snapshot and dump)

A copy of your data kept somewhere else, so you can get it back after a mistake or a failure. The course's server uses restic, a free backup program that saves encrypted snapshots (complete copies as of one moment) into a repository, an encrypted folder, plus a dump of each database: an export made by the database itself, safe while the app runs. A backup you have never restored is only a hope, so restore one into a scratch folder and compare it with the live files.

Learn it in Keep the server boring.

Baseline

The last trustworthy copy of the data, kept so each new fetch can be compared with it. "New" and "gone" only mean something relative to a baseline, so a failed or empty fetch must never overwrite it.

Learn it in Live feeds without getting banned.

C

Cache (and ETag)

A saved copy of an answer, so you never have to ask twice. Browsers cache files (a hard reload skips their saved copies), and your map code caches every geocoder answer. A server can also label a file with an ETag (a version tag) and a Last-Modified time; send them back next time and an unchanged file comes back as 304 Not Modified, with no file attached.

Learn it in Maps, charts and dashboards.

Caddy (and the Caddyfile)

The free web server the fleet uses as its reverse proxy: it receives every visitor's request, hands it to the right app and gets the padlock's certificates by itself. Its settings live in a text file, the Caddyfile, where each site block starts with an address and lists what to do with its requests; keep the master copy in git, edit it there first, then copy it to the server.

Learn it in Deploy behind one front door.

CAN-SPAM

The US law for commercial email: no misleading From or subject lines, a working opt-out you honor within 10 business days, and a valid postal address in every message. It is the floor, not legal advice; the EU, UK and Canada also expect proof of consent before the first marketing email.

Learn it in Build an email list (like this one).

CDN (vendoring and Tailwind)

A content delivery network: public servers that host popular open-source files, like a map library, so your page can load them with one line. Tailwind and DaisyUI, ready-made styling libraries, are loaded this way too. Vendoring means keeping your own copy in a vendor/ folder instead, so someone else's slow day can't become yours.

Learn it in Maps, charts and dashboards.

Certificate

A small signed file proving to browsers that a server really is myapp.yourdomain.com, issued after a check that you control the name. It is what makes the padlock work; Let's Encrypt issues them free, and Caddy requests and renews yours by itself.

Learn it in How the web actually works.

Checkout (and the Customer Portal)

Checkout is Stripe's own payment page: you send the buyer there and Stripe takes the card, so you never touch a card number. The Customer Portal is Stripe's page where customers cancel, change cards and get invoices, which is why the fleet has no billing screens of its own.

Learn it in Get paid without leaking money.

chmod

A command that sets who may open a file or folder. chmod 700 on a folder and chmod 600 on a file mean only the owner (root) can get in, read or write, which is how a secrets folder is locked down; umask 077 makes every new file root-only the same way.

Learn it in Deploy behind one front door.

Claude Code

Anthropic's AI coding assistant. It works inside your project folder: you describe a job in plain English, and it reads files, writes changes and runs commands, asking your permission first. Every app in this course was built by talking to one.

Learn it in Set up your workshop.

CLAUDE.md

The one file in your project that Claude Code reads by itself at the start of every session: your standing instructions to it. A line containing only @NOTES.md pulls your NOTES.md in too.

Learn it in Work with Claude Code.

Co-op (and condo)

A condo owner owns the unit itself, so each unit is its own record in a dataset. A co-op owner owns shares in a corporation that owns the building, so the data can hold one row for a whole building, and a total comes out wildly wrong unless you count the apartments.

Learn it in Numbers you can defend.

Collection (record, schema and relation)

In PocketBase, a collection is a table (users is one) and a record is one row in it. The schema is the list of collections with their fields, types and rules, and changing it is a migration: on a live database, only add, never rebuild. A relation field points at a record in another collection, a back-relation looks the other way, and cascade delete removes someone's items when the person is deleted.

Learn it in Accounts without building auth.

Commit (push, tag and worktree)

A commit is a saved snapshot of your project in Git, with a message saying what changed; commit before every big ask, so you can always go back. A push uploads your new commits to the copy on GitHub. A tag is a permanent name for one commit (say, what is live), and a worktree is a second folder checked out at another commit, so you can fix what's live without touching your current work.

Learn it in Set up your workshop.

Container (and image)

A sealed box that runs one program with everything it needs, made from an image, the recipe it is built from. Delete the box and the recipe stays; each fleet app runs in its own container, so when one crashes the others carry on. Docker is the tool that builds and runs them.

Learn it in Your own server.

Contrast ratio

How much lighter one color is than another, from 1:1 (invisible) to 21:1 (black on white). WCAG, the web's accessibility standard, asks for 4.5:1 for normal text at its AA level, and 3:1 for large text, outlines, icons and chart marks.

Learn it in Make it look right everywhere.

Cookie

A small note a site asks your browser to keep and send back, so it can recognize you. EU-style privacy laws require consent for the ones a site doesn't strictly need, which is what a cookie banner asks for; the course's analytics sets none, so it needs no banner. A login cookie works like a password, so never paste one into a chat.

Learn it in Know if it's working.

CORS (origin and same-origin)

A browser rule: a page may read another site's data only if that site's reply carries a header, Access-Control-Allow-Origin, allowing it. An origin is the scheme plus the full name, like https://myapp.yourdomain.com, so myapp and otherapp under one domain are different origins. Asking your own origin is always allowed, so the fleet routes outside data through its own domain: that is same-origin, and the rule never comes up.

Learn it in How the web actually works.

Crawler (index and single-page app)

A search engine's program that fetches pages and follows their links, within what robots.txt allows. The index is its library of pages read, and only indexed pages appear in results. A single-page app, one HTML page whose JavaScript draws everything else, looks nearly blank to a crawler that doesn't run JavaScript.

Learn it in Get found on Google.

CSS

The code that controls how a page looks: colors, sizes, spacing. It sits in a <style> block or its own file, and design tokens keep it organized.

Learn it in How the web actually works.

CSV

A spreadsheet saved as plain text: one row per line, commas between columns. A value containing a comma, like "Phoenix, AZ", is wrapped in quotes, so splitting every line at every comma breaks rows; use a real CSV reader.

Learn it in Build static-first.

Curated list (hard key and failing closed)

Entries a person picked and typed, with or without AI help (your rivers, stores or products, each pointing at an official id), which nobody else checks; on one project, roughly 1 in 7 were wrong. A hard key is an exact shared identifier, like an official id, unlike a name that is only similar; failing closed means that when you can't be sure, you treat it as no match rather than a match.

Learn it in Live feeds without getting banned.

curl

A command that fetches a web address and shows the raw answer, with no browser around it. curl -I asks for the headers only, which start with the status code; in Windows PowerShell, type curl.exe, because plain curl there is a different command. Its companion grep finds text in files, and a path trick is a request like /../../etc/passwd that tries to climb out of your site (test one with --path-as-is).

Learn it in Deploy behind one front door.

D

Data safety form

A questionnaire in Play Console, Google's website for app developers: what data your app collects or shares, why, whether it travels encrypted, and whether people can ask for it to be deleted. The answers appear on your store page, and they copy straight from your privacy page.

Learn it in Ship to Google Play.

Database (SQLite and unique index)

A program that keeps data in tables and answers questions about it, in SQL. SQLite is a whole database in one file, built into Python and recent versions of Node; Postgres is a database server. A unique index is a rule that refuses a second row with the same value in a column, like an email address.

Learn it in Numbers you can defend.

Dataset (row and column)

One published collection of records, usually a table: each row is one record (one ticket) and each column is one fact about it (date, place, amount). It often comes as a CSV file, and what one row stands for is the first thing to find out.

Learn it in Find an idea the data can carry.

Deep link (URL hash and parameters)

An address that opens one particular view of your app. The view can ride after the #, the hash, which never leaves the browser (#cat=money), or after a ? as URL parameters (?view=method), so a shared link reopens exactly what the sender saw.

Learn it in Build static-first.

Dependency (and standard library)

A library is someone else's code you pull in, and once your app needs it, it is a dependency: one more thing to update and trust, usually installed with npm as a package. Pin the exact version, never "latest", so a new release can't change your app overnight. The standard library is the toolbox built into a language like Node, so a program that uses only it has nothing to update or break.

Learn it in The laziest thing that works.

Deploy

Getting your files onto the server and telling the front door where they are. For a static app that is the whole job, and every later update is a file copy.

Learn it in Deploy behind one front door.

Design tokens

Named values written once, like --accent: #007aff (a hex color: red, green and blue, two characters each), and used everywhere as var(--accent), so changing one line changes everything that uses it. They live on :root, CSS's name for the page's outermost element, which is how a dark theme can swap every color at once. They are also called CSS variables.

Learn it in Make it look right everywhere.

DevTools (and the Network tab)

Tools built into desktop Chrome and Edge that show what a page is doing underneath: every file, every error. Open them with Ctrl+Shift+I (Mac: Cmd+Option+I); the Network tab lists every request the page makes, one row each, with its status, type, size and time. Looking can't break anything.

Learn it in How the web actually works.

Diff

A line-by-line comparison of two versions of a file or project: lines only in the first start with - (red), and lines only in the second start with + (green). Read the diff after every change Claude makes, so you see exactly what it edited.

Learn it in Set up your workshop.

Digital Asset Links

Google's way for a website and an Android app to vouch for each other. Your site publishes /.well-known/assetlinks.json, naming the app's package and its signing keys' SHA-256 fingerprints, short public summaries of a key; at launch, Chrome reads it and, if the signature matches, the browser bar goes away.

Learn it in Ship to Google Play.

DKIM

A DNS record that lets receivers check each email really came from you: the sender signs every message with a secret key, and the matching public key sits in your DNS at SELECTOR._domainkey.yourdomain.com. Each service that sends your mail lists its own DKIM records, often as CNAMEs, which point one name at another.

Learn it in Email that arrives.

DMARC

A TXT record at _dmarc.yourdomain.com that says what receivers should do with mail claiming your domain that passes neither SPF nor DKIM: deliver it (p=none), send it to spam (quarantine) or refuse it (reject). It can also ask receivers for reports.

Learn it in Email that arrives.

DNS

The Domain Name System, the internet's address book: it turns names people remember into the numbers computers use. You edit your domain's entries (records) at your DNS provider, usually where you bought the domain, and a change can take minutes to spread.

Learn it in How the web actually works.

Docker (network and published ports)

The tool that runs each program in its own sealed box, a container. All the fleet's containers join one private Docker network, where they reach each other by name, and publish no ports: only the front door opens ports 80 and 443, because a published port (-p) is a hole around it.

Learn it in Your own server.

Dockerfile (and Docker Compose)

A Dockerfile is the recipe Docker builds an image from: a base image, the files to copy in, what to install and what to run. Docker Compose is a file, compose.yaml, describing one or more containers, each a named service, plus a command that builds and starts them.

Learn it in Deploy behind one front door.

Domain (subdomain and URL)

A name you rent by the year, like yourdomain.com. A subdomain is a name under it, like myapp.yourdomain.com, and subdomains are free to make; each app in the course gets its own. A URL is a full web address: that name plus the path to one page or file, like https://myapp.yourdomain.com/about.html.

Learn it in How the web actually works.

Double opt-in

Signing up takes two steps: someone enters an address, then that inbox's owner clicks a link in a confirmation email. Nothing else is sent until they do, which keeps typos, bots and pranks off your list.

Learn it in Build an email list (like this one).

Drift (and the drift check)

Drift is when the live copy of a config (the Caddyfile, say) quietly stops matching the master copy, usually because someone (you, or an AI session) edited the server directly; the next deploy of the master copy then deletes that edit without a word. A drift check compares the two before every deploy and stops if the server has anything the repo doesn't.

Learn it in Keep the server boring.

Drip

Emails sent automatically on a schedule after someone signs up: lesson 1 today, lesson 2 a few days later. Nobody presses send.

Learn it in Build an email list (like this one).

E

Empty state

What a screen shows when there is nothing to show yet: a first visit, no search results, data that hasn't arrived. Designed on purpose, it says what will fill the screen, and it never shows a blank form or a made-up number.

Learn it in Numbers you can defend.

Entitlement

A named thing a customer has paid for, like myapp_pro. Stripe keeps each customer's active list; your server copies it onto the user's record and checks it before doing anything paid.

Learn it in Get paid without leaking money.

Env file (and .gitignore)

A plain text file of NAME=value lines, usually named .env, that holds a program's secrets. The program reads each line as an environment variable when it starts (process.env.NAME in Node; Docker's --env-file hands them over), so the values never sit in your code, your git repo (list the file in .gitignore, a file of names git must never track) or the web folder.

Learn it in Deploy behind one front door.

Event

A signal the browser gives your code when something happens: a tap, the page becoming visible, Chrome deciding your app is installable (addEventListener says what runs then). The course uses the word two more ways: in your saved data, an event is one logged action, like a feeding, and in analytics, a named event is a message you send yourself at a step that matters.

Learn it in Make it an app on their phone.

F

Favicon (and data URI)

The tiny icon in the browser tab. A data URI writes a whole file into an address starting with data:, so a favicon, or any small image, can sit inside your HTML with nothing extra to download.

Learn it in Make it look right everywhere.

Firewall

The rule list that decides which ports the internet may knock on. Your server's firewall should accept only 22 (SSH), 80 (HTTP) and 443 (HTTPS); an empty one blocks everything, SSH included, so add the rules before you activate it.

Learn it in Your own server.

Flat vs marginal rate

With a marginal rate, like income tax, you pay the higher rate only on the part above the line. With a flat rate, the whole value is charged at its band's rate, so crossing a line raises the entire bill.

Learn it in Numbers you can defend.

Framework (build step, FastAPI and Jinja)

A big library, like React or Vue, that organizes your code its own way; a build step compiles your code before a browser can run it. Both need installing and updating, so the course skips them until something specific forces one. On a server, FastAPI is a Python web framework and Jinja fills HTML templates with data.

Learn it in Build static-first.

Front door

The course's nickname for the reverse proxy: the one program, Caddy, that owns the server's public web ports and hands each visitor to the right app. Everything else sits behind it on a private network.

Learn it in Deploy behind one front door.

G

Geocoding (latitude and longitude)

Turning an address, ZIP code or place name into coordinates; reverse geocoding goes back. Latitude is degrees north of the equator (Phoenix is about 33.45) and longitude is degrees east or west of London (west is negative, so Phoenix is about -112.07). Geocode once, cache every answer, and mind the order: some geocoders return longitude first, while Leaflet wants latitude first.

Learn it in Maps, charts and dashboards.

Git (repo and GitHub)

Git records versions of your project's files on your computer, so it can show what changed and undo mistakes. A repo (repository) is a folder Git tracks, and GitHub is a website that keeps a copy of your repo online, private if you choose.

Learn it in Set up your workshop.

gzip

Standard compression for the trip: the server squeezes each file and the browser unpacks it. On your own server, one line in the front door's config (encode) turns it on, and a big JSON file can travel at a fraction of its size.

Learn it in Maps, charts and dashboards.

H

Hash (and salt)

A one-way scramble of a value: the same input always gives the same output, but you can never turn it back. A password hash lets a server check a guess without storing the password (and is slow on purpose, so guessing millions costs too much); a salt, a random value mixed in per user, makes equal passwords hash differently. A content hash, like SHA-256, fingerprints a file or record.

Learn it in Accounts without building auth.

Headless browser (CDP and smoke test)

A real Chrome or Edge running with no window, driven by a script that can open a page, resize it, switch on dark mode, click, collect errors and save screenshots. Scripts control it through the DevTools Protocol (CDP), the connection DevTools itself uses. A walk-through, or smoke test, uses one to act like a brand-new user and fails at the first thing that's wrong.

Learn it in Check the AI's work.

Hook

Your own JavaScript that PocketBase runs on the server at a given moment ("a user is about to be created"), or as a new route it answers, like /api/myapp/use. Hooks live in pb_hooks and skip the rules, and PocketBase reloads a changed hook file within seconds.

Learn it in Accounts without building auth.

HTML

The language a page's content is written in. index.html is the file a web server hands out for a folder's address: your app's front page. <details> is HTML's built-in fold-out, a one-line summary you tap to open, with no JavaScript needed.

Learn it in How the web actually works.

HTTPS

The encrypted version of HTTP, the language browsers and servers speak. Nobody in between can read or change the page, and the padlock in the address bar says so. It needs a certificate, and browsers allow the microphone, installing as an app and service workers only over HTTPS.

Learn it in How the web actually works.

I

Idempotent

Safe to run again: the second run changes nothing. A setup script that only adds what is missing, like the one that puts the analytics tag in a page exactly once, can be rerun without making a mess.

Learn it in Know if it's working.

inert

An HTML attribute that makes part of a page unclickable and hidden from keyboards and screen readers. A dimmed overlay only hides things visually, so without inert the Tab key walks into the app behind it; the course uses it while a terms sheet must be accepted.

Learn it in Ship to Google Play.

innerHTML (textContent and escaping)

Two ways to put text into part of a page. innerHTML reads it as HTML, so an & or a < in a name can break the page, or let an attacker slip in a script; textContent shows it exactly as written, so use it for any text that came from users or data files. Escaping does the same job by turning those characters into harmless stand-ins like <.

Learn it in Check the AI's work.

IP address

A server's number on the internet, like 203.0.113.7 (a number reserved for examples). DNS turns a name into one, and the course writes your server's as YOUR_VPS_IP.

Learn it in How the web actually works.

J

JavaScript

The programming language of web pages: the code that makes a page do things. Browsers run it, and Node.js runs it on your computer or server.

Learn it in How the web actually works.

Join (and crosswalk)

Combining two datasets by something they share, an ID or an address, so each row of one gains columns from the other. A wrong match looks exactly like a right one, so match on the strongest evidence and leave doubtful rows unmatched. A crosswalk is a table that matches one id system to another.

Learn it in Big public data on a small server.

JSON (and GeoJSON)

Data written as plain text that people and programs can both read: lists in [ ], labeled values in { }, like {"city": "Phoenix"}. GeoJSON is JSON for map shapes, each a point, line or outline with your fields attached, which map libraries read directly.

Learn it in How the web actually works.

JSON-LD (and canonical link)

JSON-LD is a hidden block in a page's HTML that tells search engines, in the shared vocabulary of schema.org, what the page is: an article by this author, a set of questions and answers. A canonical link is a line in the page's head naming its one official address, so two addresses showing the same page count as one.

Learn it in Get found on Google.

K

Keystore (signing key and Play App Signing)

Android installs and updates only signed apps. The keystore is the password-protected file that holds your private signing key; updates need the same key, so back it up and keep it out of git and your website folder. With Play App Signing, Google holds the key that signs the app for the public, and you sign uploads with your own upload key.

Learn it in Ship to Google Play.

L

Landing page (and call to action)

The page strangers arrive on, written to get them to try your app. Its call to action is the one thing you want them to do next, usually a big button, with the same words on every main button.

Learn it in Launch, honestly.

Lazy method (ladder and SKIPPED list)

The course's rule: build the smallest thing that works, and climb the ladder one rung at a time (one HTML file first, a framework last), only when something forces you. Write what you skipped on a SKIPPED list, each with the trigger that would make you build it, and what you launched without on a NOT DONE list. It stops at the trust boundary: who is logged in, who paid and where secrets live are always decided on the server.

Learn it in The laziest thing that works.

Lead magnet

Something useful you give away in exchange for an email address: a checklist, a result, a plan. A good one is worth having even if the person never opens another email; this course's quiz hands you your path before it asks for anything.

Learn it in Build an email list (like this one).

Let's Encrypt (and ACME)

A free certificate authority that browsers trust to vouch that a site really is yourdomain.com. ACME is how Caddy proves it controls the name, by serving a one-time file on port 80 (http-01) or through a handshake on port 443 (tls-alpn-01), and then collects and renews the certificate. Ask before your DNS is live and it refuses; Caddy retries, quietly using Let's Encrypt's practice staging server, whose certificates no browser trusts.

Learn it in Deploy behind one front door.

License

The owner's written permission to use something, with conditions. Creative Commons licenses are common ready-made ones: BY means credit the creator and NC means no commercial use. "Academic use only" rules out commercial use too, even a free app with a paid tier.

Learn it in Find an idea the data can carry.

Linux (Ubuntu and root)

The free operating system most servers use; Ubuntu is a popular version of it, and the one the course's server runs. root is its all-powerful admin user, the one you log in as, so protect that login.

Learn it in Your own server.

List price (cash price and negotiated rate)

Hospitals publish a list price (the "gross charge", which almost nobody pays), a cash price for people paying themselves, and a negotiated rate with each insurer. Mix the kinds, and an ordinary hospital can look like the most expensive one.

Learn it in Numbers you can defend.

Listed, unlisted and private (and basic auth)

The three ways an app can be live. Listed apps are linked from your home page and sitemap, so search engines may show them; unlisted ones work but nothing links to them and a noindex tag asks search engines to skip them; private ones sit behind a password, such as basic auth, the web's built-in password prompt, which Caddy can add. Unlisted is not secret, because bots read the public logs of HTTPS certificates.

Learn it in Launch, honestly.

localhost (and local web server)

Your computer's name for itself. http://localhost:3000 means "my own computer, door 3000" (a port), and it only works on your machine. A local web server, like npx serve, hands a folder's files to your browser over http:// the way a real server will.

Learn it in Set up your workshop.

localStorage (and sessionStorage)

A small store inside each browser, a few megabytes per site, that keeps text under a name (a key) through refreshes and reboots. It lives in one browser on one device: clearing site data erases it, private windows start empty, and nothing in it leaves the device unless your code sends it. sessionStorage is the same idea, but it empties when the tab closes.

Learn it in Build static-first.

Lookup key (products, prices and features)

In Stripe, a product is what you sell ("myapp Pro") and a price is one way to pay for it, monthly or yearly. A feature is an entitlement name, like myapp_pro, attached to products: buy one, get the feature. A lookup key is a readable name for a price, like myapp_pro_monthly, so your code never stores Stripe's long ID strings and the same code works in test and live mode.

Learn it in Get paid without leaking money.

M

Manifest (and maskable icon)

A small JSON file, manifest.webmanifest, that tells the phone your app's name, icons, colors and start page; its "display": "standalone" line makes the installed app open in its own window instead of a browser tab. A maskable icon is drawn edge to edge with everything important inside the central circle, 80% of its width, so Android can cut it into a circle or a rounded square.

Learn it in Make it an app on their phone.

Map tile

The map is a grid of square pictures, usually 256 pixels each, fetched from a tile provider's server; the map library (Leaflet, a small free one, in this course) asks only for the ones on screen at the current zoom. Every visible layer is a stream of requests someone else pays for, so a careless map can hit a rate limit.

Learn it in Maps, charts and dashboards.

MCP (and plugins)

The Model Context Protocol: a standard for plug-ins, called MCP servers, that give Claude Code real tools for an outside service. Hostinger's turns its API into tools for your VPS, domains and DNS. A plugin is a different add-on: written instructions (skills), sometimes with small scripts, installed from a marketplace, a catalog of plugins.

Learn it in Your own server.

Media query (and CSS pixels)

CSS that applies only while a condition is true, like @media (prefers-color-scheme: dark) when the device is set to dark, or @media (max-width: 720px) on a narrow screen. Widths are measured in CSS pixels, not physical dots, and several iPhones are 390 wide. An attribute is extra information in an HTML tag, like data-theme="dark", and :root[data-theme="dark"] matches only while it is there.

Learn it in Make it look right everywhere.

Methodology page

The page that shows your work: where the data comes from, how each number is calculated, what is left out and how fresh it is. Few people read it, and they are the ones who would otherwise say you're wrong.

Learn it in Numbers you can defend.

Mount (volume and inode)

Plugging a server folder into a container, which sees it at a path of its own; :ro makes it read-only. A volume is storage that survives when a container is deleted and recreated (caddy_data holds your certificates). Mount the folder, not a single file: a file mount follows the file's inode, its identity on disk apart from its name, so renaming a new file over it leaves the container reading the old one.

Learn it in Deploy behind one front door.

N

Nameserver (and zone)

Nameservers answer questions about your domain, and whoever runs them is where you edit its records. The zone is that whole list of records; some DNS tools can replace it instead of adding to it, so read the list before and after any change.

Learn it in Your own server.

Network-first (and cache-first)

Two strategies for a service worker. Network-first asks the internet and uses the saved copy only when that fails, so it is always fresh when online; cache-first answers from the saved copy and goes online only when it has none, which is fast but stale after every update.

Learn it in Make it an app on their phone.

Node.js (and modules)

A program that runs JavaScript outside a browser, so small tools written in it run on your computer or server; it brings npm with it. A module is a JavaScript file other code can load, and the course's scripts use only the modules built into Node.

Learn it in Set up your workshop.

NOTES.md

The notes file in your app's folder that Claude reads every session (through a line in CLAUDE.md), holding where things are, decisions not to undo, what you skipped and dated LESSON lines. The .md means Markdown, plain text where a line starting with # is a heading. Write where a secret lives, never the secret.

Learn it in Work with Claude Code.

npm (and npx)

npm is Node's package installer, and npx runs one tool without a permanent install, like npx serve. package.json lists your packages, and package-lock.json, the lock file, records the exact version of each, so npm ci installs exactly the same set every time.

Learn it in Set up your workshop.

null

The value programs use for "nothing here". It isn't zero: zero inches of rain is a measurement, while null means nobody measured, so never show it as 0.

Learn it in Numbers you can defend.

O

Official index (and calibrate)

A number an agency computes with a published recipe, so everyone's "AQI 150" means the same; prefer it to a score you invented. When you do compute your own, calibrate it: set it against a known answer, like zeroing a kitchen scale with the empty bowl on it, because until then a raw score means nothing.

Learn it in Numbers you can defend.

og:image

An Open Graph tag: a line in a page's head that chat apps and social sites read to draw a pasted link's preview. It names the picture by its full https:// address, and 1200×630 is the size the course uses.

Learn it in Launch, honestly.

P

Parquet (and DuckDB)

Parquet is a compact file format that stores a table column by column. DuckDB is a database that runs inside your program and queries such files with SQL, with no database server, which is how a small server can answer questions about hundreds of megabytes of data.

Learn it in Big public data on a small server.

Parse (syntax error and exit code)

Before running a script, the browser reads it through to check it is valid JavaScript: that is parsing. A syntax error is code that can't be read, like a string with no closing quote, and the browser then refuses the whole block. Checks such as node --check fail with an exit code: 0 means a command worked, anything else means it failed, and && runs the next command only after a 0.

Learn it in Check the AI's work.

PATH

The list of folders your terminal searches for commands. Installers add to it, but only terminals opened afterwards notice, so close and reopen VS Code if a tool is "not recognized" or "command not found".

Learn it in Set up your workshop.

Per-capita rate

A count divided by the number of people, so big and small places compare fairly: incidents ÷ residents × 1,000. It breaks when the people causing the count live elsewhere, as with through-traffic past a downtown.

Learn it in Numbers you can defend.

Percentile (median and IQR)

Sort the values: the 25th percentile sits a quarter of the way up and the 75th three quarters up, and the middle half between them is the IQR (interquartile range). The median is the middle value, so a few absurd prices barely move it, while the average jumps.

Learn it in Numbers you can defend.

Pipeline (and atomic swap)

A script that downloads raw data, cleans it and writes the small files your site reads; each run starts again from the raw files, so you can rerun it any time. It builds into a staging folder and swaps each finished file in with one rename, an atomic step: on one disk, anyone reading gets the old file or the new one, never half of each.

Learn it in Big public data on a small server.

Plan mode

A Claude Code setting where Claude can read files and write a plan but can't change anything until you approve it. Press Shift+Tab until the footer says plan mode on; asking for options in plan mode costs nothing.

Learn it in Work with Claude Code.

PocketBase (and superuser)

A free, open-source program that is a whole small backend in one file: a database, sign-up and login, an admin dashboard and room for your own server code, called hooks. One PocketBase serves every app in the fleet. Its admin account, the superuser, skips every rule and can read or change anything, so it is the one login that must never leak.

Learn it in Accounts without building auth.

Polling (and feeds)

Asking again on a schedule to see what changed. A feed is an address you can read again and again for fresh values: an RSS file of a site's newest posts (Substack's is at /feed), or the data behind an official map. A poller on your server asks someone else's feed slowly, within its rate limit, and keeps the last good answer, so visitors read your copy and the source never sees them.

Learn it in Live feeds without getting banned.

Port

Which door on a server you knock on: 443 for HTTPS, 80 for plain HTTP, 22 for SSH. http://localhost:3000 means your own computer, door 3000.

Learn it in How the web actually works.

Postgres (Supabase and PostgREST)

A popular free, open-source database server; Umami, the course's analytics, keeps every visit in one, and its password is hex (only 0–9 and a–f) because an @, : or / in a password breaks the database address. Supabase is a hosted service built on Postgres, PostgREST turns its tables into web addresses, and row-level security is Postgres rules about which rows each role may see.

Learn it in Add a backend only when forced.

Production

The live copy of your app that real people use. Touching production means changing anything they would notice: the server, DNS, payments, their data. Change it only when you have asked for that exact change, and ask for proof afterwards.

Learn it in Work with Claude Code.

Prompt

The message you type to Claude. The ones that get small, working results have four parts: what a person can do and sees when it works, what is out of scope, the smallest version, and how you will check it.

Learn it in Work with Claude Code.

Public resolver (and NXDOMAIN)

A big DNS server anyone can ask, like Cloudflare's 1.1.1.1 or Google's 8.8.8.8; it shows what the internet sees, not what your laptop remembers. NXDOMAIN is DNS's answer for "no such name", which some resolvers keep giving for a few minutes after you create a record.

Learn it in Deploy behind one front door.

Pure function

A function, a named piece of code that takes inputs and returns an answer, is pure when the answer depends only on what you pass in: no drawing, no clock, no saving, no internet. Same inputs, same answer, so it can be tested alone; the course puts an app's rules in one file of them, engine.js.

Learn it in Check the AI's work.

pushState (and popstate)

The browser keeps a history, its list of where you have been. history.pushState adds an entry without loading a page, and when Back removes one your page gets a popstate event; giving each popup its own entry is how Android's Back button closes a popup instead of the app.

Learn it in Ship to Google Play.

PWA

A progressive web app: an ordinary website that phones and computers can install, with its own icon and its own window and no address bar. Same files, same server, no app store; it takes a manifest, icons and, for offline use, a service worker.

Learn it in Make it an app on their phone.

R

Rate limit

A cap on how many calls a service accepts per minute, hour or day, counted per key or per IP address. Go over it and the service answers 429, "Too Many Requests", until the window resets, so do the budget math (the limit divided by the cost of one page load) before you design the fetch.

Learn it in Live feeds without getting banned.

Regular expression

A tiny language for matching text. [a-z0-9-]+ matches one or more lowercase letters, digits or hyphens, which is how code checks that a page name or id looks the way it should.

Learn it in Build static-first.

Reload (and restart)

A reload hands the running Caddy a new config, which it checks and swaps in without dropping a visitor, or refuses if it is broken. A restart stops Caddy, so every site goes dark, and stays dark if the config has an error: never restart the shared front door.

Learn it in Deploy behind one front door.

Request (response, header, GET and POST)

A request is a browser or program asking a server for something; the response is the reply. Both carry headers, labeled lines of extra information (a Host header names which site the request is for), and a response starts with a status code. GET means "show me" and only reads, HEAD asks for the headers only, and POST means "do this": only a POST should change anything.

Learn it in How the web actually works.

Reverse proxy

The program at your server's front door. Every request arrives there first, it reads the name asked for, and it hands the request to the right app behind it: one front door, many apps. In the fleet it is Caddy, which also handles HTTPS.

Learn it in How the web actually works.

robots.txt

A text file at the top of a website (yoursite.com/robots.txt) telling crawlers what they may fetch. A User-agent line names a program (* means all of them, yours included) and the Disallow lines under it list what is off-limits; if a site's robots.txt says no to you, it is no.

Learn it in Find an idea the data can carry.

Rule

In PocketBase, each collection has five rules, one each for list, view, create, update and delete, checked on every request: a condition like id = @request.auth.id ("this record is the logged-in person's"). An empty rule means everyone, logged-out visitors included, and a locked one (null) means only superusers, so your page is not the lock: the rules are.

Learn it in Accounts without building auth.

S

Screen reader

Software that reads the page aloud for people who can't see it. Give every control a visible label, or an aria-label when it has none, and mark an area that updates in place with aria-live so the reader announces the change.

Learn it in Make it look right everywhere.

Script tag

A line of HTML that loads a JavaScript file. Placed in the page's <head> (its top section, for settings rather than content) and marked defer, it never holds up the page; each app's analytics is one script tag.

Learn it in Know if it's working.

SEO

Search engine optimization: making pages a crawler can find and trust. Give each page real <a href> links, its words in the HTML itself, a clear title (usually the blue link in results) and a meta description (the sentence often shown under it), and list your pages in a sitemap.

Learn it in Get found on Google.

Server

A computer that is always on, answering requests. In this course, yours is a rented VPS that runs every app behind one front door.

Learn it in How the web actually works.

Service worker

A small script, sw.js, that your page registers once; from then on the browser runs it between your page and the network. It can answer requests from saved copies, which is what makes an app work offline, and also what can serve stale files if you cache the wrong way.

Learn it in Make it an app on their phone.

Session

One run of Claude Code, from typing claude until you close it; each new session starts knowing nothing about yesterday, which is why NOTES.md exists. A login session is the other meaning: the logged-in state a token gives your browser.

Learn it in Work with Claude Code.

Shell LLC

An LLC (limited liability company) is a cheap legal wrapper for a business. A shell exists mainly to hold property, so one company can own homes under many names, which is why owners are better grouped by where their tax bills are mailed.

Learn it in Find an idea the data can carry.

Signature (HMAC)

A code that proves a message came from someone holding a shared secret and was not changed. Stripe computes an HMAC (a keyed fingerprint, made with the SHA-256 recipe) over the exact bytes of each webhook, the raw body, and your server accepts only a match, compared in constant time so timing gives an attacker nothing. The same trick makes the signed token in an emailed confirm link impossible to forge.

Learn it in Get paid without leaking money.

Sitemap (and noindex)

sitemap.xml is a file listing every page you want search engines to find, and robots.txt can point crawlers to it. noindex is a meta tag, a line in a page's head, asking search engines to leave that page out of their results. Don't also block a noindex page in robots.txt, or crawlers never fetch the page to see the tag.

Learn it in Get found on Google.

SMTP (and transactional email)

How a program hands an email to your mail host: it logs in as the mailbox and passes each message over for delivery. Port 465 uses TLS (the encryption behind the padlock) from the first byte, while 587 starts plain and upgrades with STARTTLS; both are safe, not interchangeable. It is how transactional email, such as a verification or a password reset, leaves your app.

Learn it in Email that arrives.

SPF (and MX records)

A TXT record listing every service allowed to send email as your domain; mail from anywhere else looks forged. A domain may have only one SPF record (it starts v=spf1), so every sender goes in that one line. MX records are the other kind: they name the servers that receive your domain's mail.

Learn it in Email that arrives.

SQL

The standard language for asking a database questions about its tables. A query is one such question, like counting the rows that match a condition.

Learn it in Numbers you can defend.

SSH

A way to type commands on another computer from your own terminal, over an encrypted connection. You log in with an SSH key, a pair of files made on your laptop: the public half you can hand to anyone, and the private half never leaves your laptop and proves it is you.

Learn it in Your own server.

Static app

An app whose server only hands over files: none of your code runs there, and all the running happens in the visitor's browser. It is the course's starting point until a feature forces a backend. It also means public, because anyone can download any file in the served folder.

Learn it in How the web actually works.

Status code

The three-digit verdict that starts every response: 200 OK, 301 moved for good (a redirect), 304 not modified, 401 log in first, 402 payment required (used for "free limit reached"), 403 logged in but not allowed, 404 not found, 405 that kind of request isn't accepted, 429 too many requests, and 502 the front door couldn't reach your app.

Learn it in How the web actually works.

Streaming (memory and disk)

Reading a file a piece at a time and letting each piece go once you have used it, so memory stays flat whether the file is 5 MB or 43 GB. Loading reads the whole file into memory (RAM, the small, fast space a running program works in) first, which kills a small server; disk, where files are stored, is much bigger.

Learn it in Big public data on a small server.

Stripe (Pro and test mode)

A payment company: it takes the card and pays you, and your server talks to it through its API. Pro is the course's name for an app's paid tier, and test mode (a sandbox) is a practice copy of your account with fake cards and no real money, where the course proves every payment loop.

Learn it in Get paid without leaking money.

SVG (and canvas)

An image format made of shapes and written as text, so it can sit inside your HTML and stays sharp at any size; its viewBox sets the drawing's own coordinates. A canvas is the other way to draw: an HTML element your JavaScript paints on, then saves as a PNG.

Learn it in Make it look right everywhere.

Swap (and the OOM killer)

Swap is disk space Linux borrows as overflow memory: much slower, but it turns a crash into a slowdown. The OOM (out-of-memory) killer is Linux's last resort when memory runs out: it ends a process to save the system, and it tends to pick the biggest. The kernel, the core of Linux, names its victim in a log you read with journalctl -k.

Learn it in Big public data on a small server.

Sync

Keeping copies of the same data in agreement: each phone keeps one so the app works offline, the server keeps another, and syncing swaps changes until they match. Done naively, with "last write wins", it quietly deletes work; the course merges by id and uses tombstones.

Learn it in Sync and sharing that never lose work.

systemd (timer, cron and journal)

The program that starts and supervises everything on a modern Linux server. A .service file says what to run and a .timer file says when, a sturdier cron (Linux's classic scheduler, one crontab line per timetable). Everything a service prints lands in the journal, systemd's log, which journalctl reads.

Learn it in Big public data on a small server.

T

Tarball (and allowlist)

Many files packed into one compressed archive by the tar command. It travels as a single file, so a failed copy is one clearly broken file instead of a half-updated site, and gzip -t checks it before you unpack. Pack an allowlist, a fixed list of exactly the files that ship, never the whole project folder, which holds .git and your notes.

Learn it in Deploy behind one front door.

Terminal (CLI, shell and stdin)

A window where you type commands instead of clicking: type a line, press Enter, and the computer answers in text. A CLI (command-line interface) is a program you drive that way, and the shell is the program that reads what you type and runs it; on Windows, VS Code's terminal runs PowerShell, and on a Mac, zsh. Standard input (stdin) is the stream a command reads from, and < feeds a file into it.

Learn it in Set up your workshop.

Token (user id and JWT)

A long random string the server hands your browser when you log in, meaning "this is Sam, for now": the browser sends it with every request, and whoever holds it can act as you until it expires. The user id is the account's unique name. A JWT is a signed token: anyone can read what is inside, but only the holder of the secret can make one.

Learn it in Accounts without building auth.

Tombstone

A small note saying "record X was deleted at time T". It syncs along with the data, so every copy learns about the delete and every merge drops X instead of bringing the record back.

Learn it in Sync and sharing that never lose work.

Tracking pixel (and open rate)

A tiny invisible image in an email: when a mail app loads it, the sender logs an "open". The open rate is opens divided by emails delivered, a rough number at best, because some mail apps load every image automatically; this course's emails carry no tracking pixel.

Learn it in Build an email list (like this one).

Trust boundary

The line between what you control (your server) and what you don't (every visitor's browser). Whoever holds the browser can change anything on their side, so nothing that matters, like who is logged in or who paid, is decided there.

Learn it in The laziest thing that works.

Trusted Web Activity (and Bubblewrap)

A thin Android app whose only job is to open your website in Chrome, full-screen, with no browser bar: it shows your live site, and nothing is copied in. Bubblewrap, Google's command-line tool, generates it from your manifest, with the JDK (Java), the Android SDK (Google's build tools) and Gradle (which runs the build) downloaded for it once.

Learn it in Ship to Google Play.

try/catch (and await)

try { … } catch (err) { … } runs the first block and, if it throws an error, runs the second instead of crashing; an empty second block hides the error forever, so at least log it. await pauses a function until something slow, like a download, finishes, and the page can change in the meantime.

Learn it in Check the AI's work.

TXT record

A line in your domain's DNS holding text, not an address. Services read one to confirm you control the domain, and your email's SPF line is a TXT record too, so when you add one, never let a tool overwrite the others at that name.

Learn it in Get found on Google.

U

Umami

Free, open-source analytics that the fleet self-hosts, meaning it runs on its own server. It sets no cookies and, by its own description, collects no personal data, so there is no banner; one copy serves every app, and each page reports to it with a small background request called a beacon.

Learn it in Know if it's working.

User agent

A line each browser sends to say what it is, like Chrome on Windows. A headless browser's says HeadlessChrome, which Umami's bot filter drops; when your own server calls someone's API, send a user agent that names your app and a contact address.

Learn it in Know if it's working.

UTC (and time zone names)

The world's reference clock, which most code defaults to; its day flips at a different moment than yours (midnight UTC is 5 pm in Phoenix). Save the exact moment (Date.now()), show it in local time using the person's time zone name (America/Phoenix), and say "resets at 00:00 UTC" when a limit uses it.

Learn it in Build static-first.

UTF-8 (encodings, BOM and mojibake)

The standard way to store text as bytes, accents, dashes and emoji included. An encoding is the rule that turns bytes into letters; read bytes with the wrong one, like the older Latin-1, and you get mojibake, garbage like — where a dash should be. A BOM (byte-order mark) is an invisible marker some programs write at the start of a file, and it sticks to the first column's name if you read it naively.

Learn it in Set up your workshop.

UTM tags

Labels on the end of a link, like ?utm_source=email&utm_campaign=welcome. The page ignores them, but your analytics (Umami can report on them) records them, so you can see which email sent each visit.

Learn it in Build an email list (like this one).

V

VAPID (and web push)

Web push lets a server wake a browser with a notification even when your page is closed: each browser maker runs a push service, which gives the browser an endpoint to subscribe with. VAPID is your server's own key pair for it: the public half goes in your page, and the private half signs a short JWT on every push, proving it comes from the server the browser subscribed with.

Learn it in Make it an app on their phone.

Vertical slice

A thin piece that works all the way through, from the screen to the saved data, instead of one finished layer at a time. Tiny and ugly, but it runs.

Learn it in The laziest thing that works.

VPS

A virtual private server: your own slice of a big computer in a data center, rented by the month, running Linux. It is always on, you control it completely, and the course puts every app on one small one.

Learn it in How the web actually works.

VS Code

A free code editor from Microsoft: a program for opening and changing the files an app is made of. It has a terminal built in, and Claude Code runs inside it.

Learn it in Set up your workshop.

W

Web Share API

navigator.share opens the phone's own share sheet, and given files it shares a file your page made, which matters because file downloads do nothing inside the Android wrapper. It must run from a tap, and navigator.canShare says first whether the phone accepts that file.

Learn it in Ship to Google Play.

Webhook

An address on your server that another service calls when something happens, like a payment, so it runs the opposite way from an API. Anyone can send a webhook address a fake message, so only a request whose signature checks out may change anything.

Learn it in Get paid without leaking money.

WebSocket

A connection that stays open, so a server and a browser can push messages to each other instantly. wss:// is its encrypted form, as https:// is for pages.

Learn it in Add a backend only when forced.

Y

YAGNI

"You Aren't Gonna Need It": build nothing until a real need shows up, because everything you build must be kept working.

Learn it in The laziest thing that works.