Glossary
Plain-language definitions of the tech, AI and marketing terms used across this site.
AI
Retrieval-Augmented Generation: the model answers from documents you retrieve at query time, so responses stay grounded in your own data.
Related Embedding · Reranking · Faithfulness · Eval · Agent
An eval metric: how well an answer stays grounded in the retrieved context, with nothing invented.
Related Eval · RAG · Reranking · Guardrails
Automated scoring of an AI system’s output (faithfulness, relevancy, precision…) so quality is measured, not guessed.
Related Faithfulness · RAG · Reranking
A numeric vector that represents the meaning of text, used to find semantically similar content.
A second-pass model that re-scores retrieved candidates for relevance, sharpening precision before generation.
Related RAG · Embedding · Faithfulness · Eval
An LLM that can plan and call tools in a loop to complete a task — not just answer once.
Related RAG · Guardrails · Prompt injection
Rules and checks around an AI system that constrain inputs, outputs and tool use to keep it safe and on-policy.
Related Jailbreak · Prompt injection · Agent · Faithfulness
An attempt to trick an AI into ignoring its safety rules or system instructions.
Related Prompt injection · Guardrails
An attack that hides malicious instructions inside content the model reads, hijacking its behaviour.
Related Jailbreak · Guardrails · Agent
A structured, machine-readable map of entities — people, companies, places — and the relationships between them. It’s what answer engines use to recognise your brand as a real, specific thing.
Related Structured data · Entity · Wikidata · JSON-LD · Answer engine
Dev
Middleware that carries messages between producers (which publish) and consumers (which process) — Kafka, RabbitMQ, NATS, NSQ, or AWS SNS/SQS. It decouples the two sides: producers don't know who consumes, and consumers can be added or restarted without touching producers.
Read the explainer →Related Topic (messaging) · Consumer group · Fan-out · Partition (Kafka)
The named destination a producer publishes to and consumers read from. Every consumer group subscribed to a topic gets its own copy of the messages. Kafka and NSQ call it a topic; NATS calls it a subject; RabbitMQ routes to it through an exchange.
Related Message broker · Consumer group · Partition (Kafka)
An independent unit of consumption on a topic — it gets its own copy of every message and tracks its own progress. Several workers inside one group share the work round-robin. Kafka calls it a consumer group, NSQ a channel, RabbitMQ and AWS a queue.
Related Message broker · Topic (messaging) · Partition (Kafka) · Fan-out
Delivering one published message to many independent consumer groups at once — each gets its own copy. It's the difference between broadcasting to every subscriber and handing a single job to one worker.
Related Message broker · Consumer group · Topic (messaging)
Kafka's unit of ordering and parallelism: a topic is split into partitions, and each partition is read in order by at most one consumer in a group. So the partition count caps how many workers a group can use — extra consumers sit idle.
Related Topic (messaging) · Consumer group · Message broker
A microservices principle: keep business logic in the services (the smart endpoints) and let the network layer — the API gateway and service mesh (the dumb pipes) — do only routing and generic security. It avoids duplicating auth logic while keeping each service in charge of its own data rules.
Read the explainer →Related Zero Trust · API gateway · Service mesh · mTLS (mutual TLS)
A security model that trusts nothing by default: every request re-proves who it is at every hop, and unlocking one layer never grants the next. 'A lock for a lock, repeat.'
Related Defense in depth · mTLS (mutual TLS) · Service mesh
The single front door at the edge of a system. It authenticates requests (validates the JWT), rate-limits, blocks bad traffic, and strips client-sent identity headers before anything reaches your internal services. Kong and AWS API Gateway are common ones.
Related Service mesh · Smart endpoints, dumb pipes · Zero Trust
An infrastructure layer that puts a sidecar proxy (usually Envoy) next to every service to handle mTLS, retries, and traffic policy — without changing app code. Istio, Linkerd, and Consul are common meshes.
Related API gateway · mTLS (mutual TLS) · Smart endpoints, dumb pipes
Mutual TLS — both sides of a connection present a certificate and prove they own its private key, so a service refuses any peer without a mesh-signed certificate. It turns the network itself into a lock, blocking spoofed requests before a single header is read.
Related Certificate Authority (CA) · Service mesh · Zero Trust
Stacking independent security controls so no single failure is fatal. If an attacker picks the first lock (the gateway) they hit a second (the mesh) and a third (the app) — each re-proving the request.
Related Zero Trust · mTLS (mutual TLS)
A shared, reusable set of UI building blocks — buttons, cards, forms, colors, type — drawn once and agreed once, so every surface looks and behaves consistently instead of being rebuilt by hand each time.
Read the explainer →Related Monorepo · Changeset · Cloudflare Pages
One repository that holds many packages or apps together, instead of a separate repo for each — one place to read, build, and CI, while each package can still version and publish on its own.
Related npm workspace · Changeset · Design system
npm's built-in way to manage many packages in one repo: they install together and link to each other locally, so a change in one is picked up by the others without publishing first.
Related Monorepo · Peer dependency
A dependency a package expects its host app to already provide (e.g. React), rather than bundling its own copy — so a consumer app ends up with one shared React, not one per component.
Related npm workspace
A small file you commit describing an intended release — which package(s) bump, by how much (patch/minor/major), and a changelog line. A tool then applies all pending changesets to bump versions, write changelogs, and publish.
Read the explainer →Related Semantic versioning · CI/CD · GitHub Packages
The MAJOR.MINOR.PATCH version scheme: patch for backward-compatible fixes, minor for backward-compatible features, major for breaking changes — so a version number tells consumers what to expect from an upgrade.
Related Changeset
GitHub's package registry. For npm it maps a package scope (@owner) to a GitHub account of the same name, so packages publish and install under the account that owns the repo, gated by a token.
The @owner/ prefix on a package name (e.g. @labspangaea/ds-button) that groups related packages under one namespace. On GitHub Packages the scope must match the owning GitHub account.
Related GitHub Packages
Cloudflare's hosting for static sites and front-ends: you upload a built dist/ folder (via wrangler or Git) and it serves it fast from the edge, with free TLS and custom domains.
Related SSG · CNAME record · Design system
An architecture that splits a front-end into independently-built, independently-deployed pieces owned by different teams — the front-end equivalent of microservices.
Related Module federation · Monorepo · Design system
A technique where one app (the host) loads code from another (a remote) at runtime, so pieces ship separately. Powerful for micro-frontends, but client-side — the host fetches remotes with JavaScript, so crawlers see less.
Related Micro-frontend
YAGNI — "You Aren’t Gonna Need It" — a rule of thumb to not build a capability until it is actually needed, so you do not pay for and maintain speculative complexity.
Related Monorepo
Data is encrypted on the sender's device and only decrypted on the recipient's — the server in between only ever holds ciphertext it cannot read.
Read the explainer →Related Zero-knowledge · AES-256-GCM · Web Crypto API
A design where the server has no knowledge of the data's contents — it stores only encrypted blobs it cannot decrypt, so a seizure or subpoena yields nothing readable.
Related End-to-end encryption · Warrant canary
A 256-bit symmetric cipher with built-in authentication (GCM) — the standard for encrypting data so it can't be read or silently tampered with.
Related End-to-end encryption · Web Crypto API
The browser's native cryptography API (crypto.subtle) — audited, hardware-accelerated primitives like AES-GCM, run in the browser without a library.
Related AES-256-GCM · WebAssembly
A portable binary format that runs at near-native speed in the browser (and on edge runtimes), letting languages like Rust compile to the web.
Related Cloudflare Worker · Web Crypto API
Serverless code that runs at Cloudflare's edge, close to users — no server to manage. Can be written in JavaScript or, via WASM, in Rust.
Related Workers KV · Durable Object · WebAssembly
Cloudflare's global key-value store — great for reading small values at the edge, but eventually consistent and with no atomic increment.
Related Cloudflare Worker · Durable Object
A single-instance, single-threaded stateful object on Cloudflare Workers — its serialized execution makes read-modify-write atomic with no locks, unlike KV.
Read the explainer →Related Workers KV · Cloudflare Worker · Token bucket
A rate-limiting algorithm: a bucket holds up to N tokens, refilling over time; each request spends one — allowing bursts up to N while capping the sustained rate.
Related Durable Object
A dated public statement that the operator has received no secret government data request. If it stops being updated, users infer it can no longer be truthfully affirmed.
Related Zero-knowledge
Continuous Integration / Continuous Delivery: automated build, test and deploy on every change.
Read the explainer →Related Pull request · Docker · Kubernetes
Vulnerability Assessment & Penetration Testing: security testing that finds and exploits weaknesses before attackers do.
Related Cross-site scripting (XSS) · WAF · Least privilege
A pull-based delivery method: a live board with work-in-progress limits and continuous flow.
Related Scrum · Pull request
A delivery method using fixed-length sprints with a committed scope and regular ceremonies.
Related Kanban · Pull request
A tool that packages a service and its dependencies into a portable container that runs the same everywhere.
Related Kubernetes · CI/CD · VPS
An orchestrator that deploys, scales and self-heals containerised services across machines.
The ability to understand a system’s internal state from its traces, metrics and logs.
Application Performance Monitoring: traces and metrics that surface latency, errors and bottlenecks across services.
Related Observability · SLO
Service Level Objective: a target for a reliability metric (e.g. 99.9% uptime) that alerts are tied to.
Related Observability · APM
Domain Name System: the internet’s phone book — it turns a name a human types (pangaea.id) into the numeric IP address a machine can connect to.
Read the explainer →Related Nameserver · Recursive resolver · Authoritative DNS · DNSSEC · Propagation
DNS Security Extensions: cryptographic signatures on your DNS records, so a resolver can prove an answer is genuine and untampered — closing DNS’s spoofing / cache-poisoning gap. Authenticity, not encryption.
Read the explainer →Delegation Signer: a fingerprint of your DNS signing key, lodged with the registry via your registrar, so the parent zone (.id) vouches for your key — the link that completes the DNSSEC chain of trust.
Read the explainer →The authoritative server that holds a domain’s DNS records and answers lookups for it. Whoever runs your nameservers controls your DNS.
Read the explainer →Related DNS · Authoritative DNS · Registrar · Recursive resolver
Announcing one IP address from many data centers at once, so the internet routes each request to the nearest copy — cutting distance, and latency.
Read the explainer →Related CDN · Edge · Round trip
The wait after a DNS change while the rest of the world’s cached copies expire and pick up the new answer — usually minutes, up to 24 hours.
Read the explainer →Related DNS · TTL · CNAME record
Mail eXchange: the DNS record that says where mail addressed to your domain should be delivered. Read by the sender’s server.
Read the explainer →Sender Policy Framework: a published allow-list of the servers permitted to send mail “as” your domain. Checked by the recipient’s server.
Read the explainer →DomainKeys Identified Mail: a cryptographic signature on each outgoing message — a private key signs it, and a public key in DNS lets the receiver verify the mail is genuinely yours and untampered.
Read the explainer →Domain-based Message Authentication, Reporting & Conformance: ties SPF and DKIM together, tells receivers what to do when a message fails (monitor, quarantine, reject), and emails you reports.
Read the explainer →Simple Mail Transfer Protocol: the protocol that moves email between servers. It has no built-in way to prove who sent a message — which is why SPF, DKIM and DMARC exist.
Read the explainer →Certification Authority Authorization: a DNS record listing which Certificate Authorities may issue an HTTPS certificate for your domain. Omit a CA your provider uses and the next auto-renewal silently breaks.
Read the explainer →Related Certificate Authority (CA) · TLS
Transport Layer Security (the modern name for SSL): the encryption behind the padlock — it scrambles traffic so nobody between the visitor and the site can read or tamper with it.
Read the explainer →Related HSTS · Certificate Authority (CA) · CAA record · CSP
HTTP Strict Transport Security: a header that tells the browser to only ever reach a site over HTTPS, so there’s no insecure first hop to intercept. It’s sticky — browsers remember it for the whole max-age.
Read the explainer →Content-Security-Policy: an allow-list of where scripts, styles, fonts and images may load from. Anything not on the list is refused — the strongest single defence against cross-site scripting.
Read the explainer →Related Cross-site scripting (XSS) · WAF · TLS · HSTS · Least privilege
Web Application Firewall: a managed ruleset that blocks known attack patterns (SQL injection, common exploit probes) at the edge, before they reach your app.
Read the explainer →Related CSP · Cross-site scripting (XSS) · Least privilege
Content Delivery Network: a fleet of servers in hundreds of cities that each hold a copy of your files close to real visitors, so requests are answered nearby instead of from one far-off origin.
Read the explainer →The CDN server nearest the visitor — where the cached page is served from. Most requests are answered at the edge and never travel all the way to the origin.
Read the explainer →Related CDN · Cache · Anycast · Round trip
A saved copy of a file kept close to the visitor so it doesn’t have to be rebuilt or refetched every time. A `Cache-Control` header sets how long a copy stays good.
Read the explainer →Related CDN · Edge · Cache-busting · TTL · Ephemeral data
Static Site Generation: building every page into plain HTML ahead of time, so it can be cached and served instantly — and so crawlers and AI that don’t run JavaScript still see the full content.
Related Server-side rendering (SSR) · Prerender · Single-page app (SPA)
Time To Live: how long a cached copy — a DNS record, or an HTTP response — stays valid before it has to be fetched fresh.
Related Cache · Propagation · Recursive resolver · Cache-busting · CDN
The company you buy and renew a domain through — and where you set which nameservers are authoritative for it.
Related Nameserver · Authoritative DNS · DS record
The nameserver that holds the definitive DNS records for a domain and answers queries about it — the source of truth a resolver ultimately trusts.
Related DNS · Nameserver · Recursive resolver · Registrar
The nameserver that does the legwork of a DNS lookup for you — asking the root, the TLD, then the authoritative server in turn until it has the answer, then caching it.
Related DNS · Authoritative DNS · Nameserver · TTL
The DNSSEC record that carries the cryptographic signature for a set of DNS records, proving they haven’t been tampered with in transit.
Read the explainer →A DNS record that points one name at another as an alias; CNAME flattening lets it work even at the bare apex domain, where a raw CNAME isn’t allowed.
Related Canonical URL · Propagation
One there-and-back exchange between a client and a server. Latency is often counted in round trips, so cutting them is how you make a page feel fast.
The HTTP header a client sends to identify itself — which browser a visitor uses, or which crawler/bot is fetching the page.
Related Crawler · HTTP status code
Virtual Private Server: a slice of a physical machine you rent and manage like your own server — root access, but shared hardware.
Related Docker · Kubernetes
A trusted body that verifies you control a domain and issues the TLS certificate that makes HTTPS work; browsers ship with the list of CAs they trust. It holds the master private key and is the only thing able to sign certificates — on the public internet that's DigiCert or Let's Encrypt, and inside a service mesh it's the mesh's own control plane. Peers verify a certificate against the CA's public key with local math, no network call.
Read the explainer →Related TLS · CAA record · mTLS (mutual TLS) · Service mesh
An attack that injects malicious scripts into a page so they run in other visitors’ browsers — stealing sessions or data. A strict CSP is the main defence.
A small piece of data a site stores in your browser and sends back on every request — how a site remembers you're logged in between page loads. Security flags (SameSite, HttpOnly, Secure) control when it travels and who can read it.
Read the explainer →Related Session cookie · SameSite · HttpOnly · Secure flag
The cookie that holds your login/session token — the one that proves who you are to the server. Because stealing it means impersonating you, it's the cookie you lock down with Secure, HttpOnly, and SameSite.
Read the explainer →Related Cookie · SameSite · HttpOnly · Session hijacking
A cookie attribute that controls whether the cookie rides on cross-site requests. Strict sends it only on same-site requests; Lax also on top-level link clicks (the default); None on everything (and then requires Secure). It is the built-in defence against CSRF.
Read the explainer →Related Cookie · CSRF · HttpOnly · Secure flag · Site (same-site) · Top-level navigation · Subresource request
A cookie flag that hides the cookie from JavaScript — document.cookie can't read it. It doesn't stop XSS, but it stops an XSS script from stealing the session token and replaying it elsewhere.
Read the explainer →Related Cookie · Cross-site scripting (XSS) · Secure flag · SameSite
A cookie flag that sends the cookie only over HTTPS, never plain HTTP — so it can’t be sniffed in transit on an untrusted network. SameSite=None requires it.
Read the explainer →Cross-Site Request Forgery: an attack where a malicious site makes your browser fire an authenticated request at a site you're logged into — the browser attaches your cookie automatically. SameSite=Lax and CSRF tokens are the defences.
Read the explainer →Related SameSite · Cross-site scripting (XSS) · Cookie · Top-level navigation · Same-origin policy
The browser rule that isolates sites from each other: script on one origin can't read another origin's data, cookies, or responses. It's why an XSS script sees only its own site's document.cookie, and why cross-site reads are blocked.
Related Origin · Site (same-site) · CORS · Cross-site scripting (XSS) · CSRF · Cookie
Cross-Origin Resource Sharing: the opt-in headers a server sends to let a specific other origin read its responses — a controlled exception to the same-origin policy. It governs reading a response, not whether the request is sent.
Related Same-origin policy · Origin · Cross-origin · Cross-site scripting (XSS)
Taking over a user's session by getting hold of their session token — via a stolen cookie, a sniffed request, or an XSS exfiltration. HttpOnly, Secure, and SameSite each cut off one of those routes.
Related Session cookie · Cross-site scripting (XSS) · HttpOnly
Scheme + host + port, all three exactly matching — https://app.example.com:443. It is the browser's strictest boundary: api.example.com and www.example.com are as foreign to each other as example.com and evil.com. Reading a fetch() response, DOM access between frames, and localStorage are all governed by origin.
Read the explainer →Related Site (same-site) · Cross-origin · Same-origin policy · CORS · Registrable domain
Scheme + registrable domain, with the port and every subdomain ignored — a looser boundary than origin. app.example.com and api.example.com are cross-origin but same-site, which is exactly why a cookie can be shared between them while SameSite still blocks evil.com.
Read the explainer →Related Origin · Registrable domain · Public Suffix List · Schemeful same-site · SameSite
The domain you can actually buy: one label more than the public suffix (eTLD+1). It is not "the last two labels" — under co.uk the registrable domain of shop.example.co.uk is example.co.uk, not co.uk. This is what "site" collapses down to.
Read the explainer →Related Site (same-site) · Public Suffix List · Origin
A hand-maintained list of domain suffixes under which anyone may register a name — .com, .co.uk, and also github.io. Browsers use it to find the registrable domain, so every business registered under co.uk is a separate site, and one GitHub Pages user cannot set cookies for another.
Read the explainer →Related Registrable domain · Site (same-site)
The modern rule that counts http:// and https:// as two different sites, so a cookie set on HTTPS is not sent to the plain-HTTP version of the same domain. Older browsers ignored the scheme; a network attacker could abuse that to plant or read cookies.
Read the explainer →Related Site (same-site) · TLS · SameSite
A request a page fires while staying put — fetch, XHR, an <img>, a <script>, an <iframe>. The address bar never changes and the page's own JavaScript can read the reply, which is why SameSite=Lax withholds the cookie on every one of them.
Read the explainer →Related Top-level navigation · SameSite · CORS · CSRF
A request or access that crosses an origin boundary — a different scheme, host, or port. Cross-origin is not the same as cross-site: two subdomains of one domain are cross-origin yet same-site, and CORS (not SameSite) is what governs reading the response.
Related Origin · Site (same-site) · CORS · Same-origin policy
The Set-Cookie field that widens a cookie from one host to a whole domain suffix — Domain=.example.com sends it to every subdomain. It is its own rule, neither origin nor site: it decides which hosts receive the cookie, while SameSite decides which requests carry it.
Read the explainer →Related Cookie · Site (same-site) · SameSite · Session hijacking
A browser-set request header that tells your server how the request was triggered — same-origin, same-site, cross-site, or none (typed in directly). Because the browser sets it and script cannot forge it, it's a cheap server-side CSRF check alongside SameSite.
Related Site (same-site) · SameSite · Top-level navigation
A 2×2 table that sorts every test result into four boxes by comparing the call (positive/negative) to reality (true/false): true positive, false positive, false negative, true negative. It is how you read the accuracy of any yes/no test.
Read the explainer →Related True positive · False positive · False negative · True negative · Sensitivity · Specificity
The test said "yes" and reality was yes — a correct positive call. On a disease test, the patient is sick and the test catches it.
Read the explainer →Related Confusion matrix · False negative · True negative · False positive
The test said "yes" but reality was no — a false alarm. Also called a Type I error. A spam filter flagging a real email is a false positive.
Read the explainer →Related Confusion matrix · False negative · True positive · Specificity
The test said "no" and reality was no — a correct negative call. A healthy patient the test clears is a true negative.
Read the explainer →Related Confusion matrix · True positive · False positive · False negative
The test said "no" but reality was yes — a miss. Also called a Type II error. In disease screening it is the dangerous one: a missed diagnosis.
Read the explainer →Related Confusion matrix · False positive · True negative · Sensitivity
How rarely a test misses a real positive — the share of truly-positive cases it catches (few false negatives). A very sensitive screening test rarely lets a sick patient slip through. Also called recall.
Read the explainer →Related Specificity · False negative · Confusion matrix
How rarely a test wrongly flags a real negative — the share of truly-negative cases it clears (few false positives). A very specific test rarely raises a false alarm.
Read the explainer →Related Sensitivity · False positive · Confusion matrix
A security principle: give every token, account or service the minimum permissions it needs to do its job, and nothing more — so a leak does the least damage.
Changing a file’s name when its contents change — usually by adding a content hash — so browsers fetch the new version instead of serving a stale cached one.
Read the explainer →The three-digit code an HTTP response carries to say what happened — 200 OK, 301 moved permanently, 404 not found, 500 server error.
Related Soft 404 · 301 redirect · noindex
A missing page that wrongly returns HTTP 200 instead of 404, so search engines treat an empty “not found” page as a successful one — and penalise the site for it.
Read the explainer →Related HTTP status code · noindex · Single-page app (SPA)
A robots directive — a meta tag or an HTTP header — that tells search engines not to index a page. We use it on the 404 page.
Related HTTP status code · Soft 404 · Sitemap
A site that loads one HTML shell, then lets JavaScript swap views in the browser instead of fetching a fresh page per route. Snappy in-app, but crawlers that don’t run JS see an empty shell — which is why we prerender.
Related SSG · Server-side rendering (SSR) · Prerender · Soft 404
Generating a route’s full HTML at build time, so crawlers and visitors get a complete page with no JavaScript required — the opposite trade-off to a client-rendered SPA.
Related SSG · Server-side rendering (SSR) · Single-page app (SPA)
Rendering a page’s HTML on the server for each request — as opposed to building it ahead of time (SSG) or assembling it in the browser (SPA).
Related SSG · Prerender · Single-page app (SPA)
A JSON format for embedding structured data in a page, so search engines and AI can read what the page means — not just the words it shows.
Related Structured data · Knowledge graph
A hidden form field a real person never sees. Bots fill it in anyway, revealing themselves as spam — so the submission can be quietly discarded.
A proposed set of code changes opened for review and automated checks before it merges into the main branch.
A browser API for GPU-accelerated 2D and 3D graphics — what powers interactive 3D scenes rendered right inside a web page.
The runtime automatically reclaiming memory a program can no longer reach, so you don’t have to free it by hand — at the cost of a little background work.
Read the explainer →Related Heap (memory) · Stack (memory) · Pointer · Escape analysis · JVM
Fast, per-function memory that’s freed automatically the moment the function returns. Values that don’t outlive their function live here.
Related Heap (memory) · Garbage collection · Escape analysis
Longer-lived, shared memory for values that must outlast the function that created them. It’s reclaimed by garbage collection, not automatically.
Related Stack (memory) · Garbage collection · Pointer · Escape analysis
A value that holds the address of another value, so code can share and mutate the same data instead of copying it around.
Related Heap (memory) · Garbage collection · Escape analysis
Go’s lightweight unit of concurrency. They’re cheap enough to run thousands at once, unlike heavyweight OS threads.
Related Garbage collection · Stack (memory) · JVM
The compiler step that works out whether a value can stay on the cheap, auto-freed stack or must "escape" to the slower heap — it escapes only when something outside the function still points to it after the function returns.
Related Stack (memory) · Heap (memory) · Garbage collection · Pointer
A database that stores values and fetches them by an exact key, without looking inside the value — the simplest, fastest lookup model.
Read the explainer →Related Document database · Wide-column store · NoSQL · Aggregate store · Dynamo (Amazon)
A database where each record is a self-contained, JSON-like document you can query by any field inside it — a flexible schema, no rigid tables.
Read the explainer →Related Key-value store · Wide-column store · NoSQL · Aggregate store
A write-optimised database that spreads huge, time-keyed write volumes across many nodes — built for relentless ingest at scale (Cassandra, ScyllaDB).
Read the explainer →Related Key-value store · Document database · Columnar database · LSM-tree · Aggregate store
An analytics database that stores each column separately, so it can scan and aggregate billions of rows fast — but it’s poor at single-row reads and writes.
Read the explainer →Related Wide-column store · OLAP · MPP · Parquet · Apache Arrow
A database that stores nodes and the relationships between them as first-class data — built for multi-hop "who connects to whom" queries that joins make slow.
Read the explainer →Related Graph traversal · Cypher · Index-free adjacency · NoSQL
The classic tables-and-joins database with a strict schema and ACID guarantees — the safe default when your data is relational and consistency matters.
Read the explainer →Related SQL · JOIN (SQL) · ACID · NoSQL · OLTP
Online Transaction Processing: a workload of many small, fast reads and writes of single records — the everyday pattern behind an app’s live database.
Related OLAP · Relational database · ACID
Online Analytical Processing: a workload of heavy scan-and-aggregate queries over huge datasets — analytics and reporting, not transactions.
Related OLTP · Columnar database · MPP
Log-Structured Merge-tree: a write-optimised design — new writes are appended to memory and a log (fast, because nothing is updated in place), then merged into sorted files in the background. The engine behind many wide-column stores.
Related Memtable · SSTable · Compaction · Bloom filter · Wide-column store
A marker written in place of a deleted record, so an append-only store knows the record is gone without having to rewrite the old data right away.
Related Compaction · SSTable · LSM-tree
The field you pick up front to split data across machines. Choose it to match how you’ll read the data — a bad shard key is painful to undo later.
Related Horizontal scaling · Snowflake ID · Wide-column store
A way to describe how an algorithm’s work grows as its input grows — ignoring constants and hardware — so you can compare approaches before you ever run them.
Read the explainer →Related Time complexity · Recursion · Binary search · Memoization
How the number of steps an algorithm takes scales with the size of its input, written in Big-O — the headline measure of how it behaves on large inputs.
Read the explainer →Related Big-O notation · Binary search · Recursion
Finding an item by repeatedly halving a sorted range until you land on it — O(log n) work, instead of checking every element one by one.
Related Big-O notation · Time complexity · Recursion
A function that solves a problem by calling itself on a smaller piece of it, until it reaches a base case simple enough to answer directly.
Related Big-O notation · Memoization · Binary search · Time complexity
Caching a function’s results so that repeated calls with the same input return instantly instead of redoing the work.
Related Recursion · Big-O notation · Cache
A small, focused moment of interface feedback — a hover, a press animation, a toggle — that collectively make software feel considered and alive.
Structured Query Language: the standard declarative language for querying and updating relational databases — you describe the rows you want and the engine works out how to fetch them.
Related Relational database · NoSQL · JOIN (SQL)
An umbrella term for databases that drop the relational tables-and-joins model — key-value, document, wide-column and graph stores — usually trading strict consistency for scale or flexibility.
Related Relational database · Key-value store · Document database · Wide-column store · Graph database
Atomicity, Consistency, Isolation, Durability: the four guarantees that make a database transaction all-or-nothing and durable, so committed data is never left half-written.
Related CAP theorem · Relational database · Eventual consistency · OLTP
When a distributed database is split by a network failure, it can keep only two of three guarantees: Consistency (every read sees the latest write), Availability (every request still gets an answer), and Partition tolerance (it keeps running despite the split). Because the split itself is unavoidable, the real choice is C vs A — stay consistent and reject some requests (CP), or stay available and risk stale reads (AP).
Related Eventual consistency · ACID · Raft
A SQL operation that combines rows from two or more tables on a shared key — how a relational database assembles an answer that spans tables, at the cost of work at query time.
Related SQL · Relational database · Graph traversal
An in-memory, sorted write buffer in an LSM-tree store: new writes land here first and are acked immediately, then flushed to disk in batches.
Related LSM-tree · SSTable · Compaction
Sorted String Table: an immutable, sorted file an LSM-tree store flushes its writes into. Reads merge several SSTables; background compaction keeps their number down.
Related LSM-tree · Memtable · Compaction · Bloom filter
A compact, probabilistic index that can say a key is definitely not in a file (or maybe is) — so a read can skip files it knows can’t hold the key, without touching disk.
The background job in an LSM-tree store that merges many small sorted files into fewer larger ones, dropping superseded rows and tombstones — the housekeeping that keeps reads fast.
Massively Parallel Processing: one query is split across many machines that each scan their own slice at the same time, then the partial results are merged — like a team sharing out a phone book to search it at once. How columnar engines crunch billions of rows fast.
Related Columnar database · OLAP · Parquet
Neo4j’s declarative graph query language, where you draw the pattern you want as ASCII-art — `(a)-[:FRIEND]->(b)` — instead of writing joins.
Related openCypher · GQL · Graph database · Graph traversal
The open specification of Cypher that Neo4j released so other engines (Amazon Neptune, Memgraph) could adopt the same graph query syntax — not locked to one vendor.
Graph Query Language: the ISO standard graph query language (2024), seeded by openCypher, so graph queries aren’t tied to a single product.
Related Cypher · openCypher
An open columnar file format that stores data column-by-column with heavy compression — the on-disk shape behind many analytics and time-series engines.
Related Columnar database · Apache Arrow · MPP
An open, in-memory columnar data format designed so analytics systems can share data without copying or re-serialising it between them.
Related Parquet · Columnar database
Time-Structured Merge tree: InfluxDB’s LSM-tree variant tuned for time-series — append-heavy writes batched in memory then merged into compressed, time-ordered files.
Related LSM-tree · Downsampling · Retention policy · Time-bucketing
Rolling fine-grained time-series points up into coarser summaries (per-minute → per-hour averages), so old data stays useful without keeping every raw point.
Related TSM (Time-Structured Merge tree) · Retention policy · Gap-filling · Time-bucketing
A time-series query feature that fills slots where no data point arrived — carrying the last value forward or interpolating — so a chart has no holes.
Related Time-bucketing · Downsampling
Grouping time-series rows into fixed windows (every 5 minutes, every hour) so you can aggregate per window — the everyday building block of time-series queries.
Related Downsampling · Gap-filling · TSM (Time-Structured Merge tree) · Retention policy
Change Data Capture: streaming every insert, update and delete out of a source database as an ordered change log, so another system (often a columnar analytics copy) can stay in sync.
Related Columnar database · OLAP
Walking a graph relationship by relationship — one “hop” at a time — to answer questions like friends-of-friends; the deeper the traversal, the more a graph store outpaces joins.
Related Graph database · Index-free adjacency · Cypher · JOIN (SQL)
In a native graph store, each node holds direct pointers to its neighbours, so following a relationship is a single pointer hop — like already knowing a friend’s address instead of looking it up. No index lookup, no join.
Related Graph database · Graph traversal
Adding more machines to share the load (scaling out), rather than buying one bigger machine (scaling up) — how distributed stores absorb growth.
Related Shard key · Snowflake ID · Wide-column store
A rule that automatically drops time-series data older than some age, so a store keeps only the window you still query and doesn’t grow forever.
Related TSM (Time-Structured Merge tree) · Downsampling · Time-bucketing · Ephemeral data
Data that’s expected to be short-lived and disposable — a cache entry, a session — safe to evict or expire at any time because it can be recomputed or refetched.
Related Cache · EVCache · TTL · Retention policy
Amazon’s 2007 key-value design that deliberately trades strong consistency for high availability — the lineage behind DynamoDB and a generation of always-on NoSQL stores.
Related Key-value store · Eventual consistency · EVCache
Netflix’s distributed in-memory caching tier, built on memcached — it holds ephemeral, TTL’d data that can be evicted any time, fronting its slower stores.
Related Ephemeral data · TTL · Cache · Dynamo (Amazon)
Java Virtual Machine: the managed runtime Java and Scala run on. Its garbage collector can pause an app at inconvenient moments — one reason Discord left Cassandra (JVM) for ScyllaDB (C++).
Related Garbage collection · Goroutine · Wide-column store
A relaxed guarantee where replicas may briefly disagree after a write but converge to the same value over time — the trade an AP store makes to stay available.
Related CAP theorem · Dynamo (Amazon) · ACID · Raft
A consensus algorithm: a group of replicas elect a leader and all agree on the same ordered log of changes — like a committee that follows one chair and keeps identical minutes — so the group survives a failure without losing or reordering committed data.
Related CAP theorem · Eventual consistency
A scheme for generating unique, roughly time-ordered 64-bit IDs across many machines without coordination — popularised by Twitter, used by Discord to order messages.
Related Shard key · Horizontal scaling
Martin Fowler’s umbrella term for databases that keep each record as one self-contained chunk (an “aggregate”) read and written as a whole — key-value, document and wide-column stores. The opposite camp, graph and relational stores, lets you query freely across records instead.
Related Key-value store · Document database · Wide-column store · Graph database · Relational database
Marketing
The customer journey through awareness, consideration, conversion and retention.
Related ROAS · CPA · Click-to-WhatsApp
Return On Ad Spend: revenue generated per unit of advertising spend.
Cost Per Acquisition: what it costs in marketing spend to win one customer.
An ad that opens a WhatsApp chat on tap, turning ad spend into direct conversations.
Generative Engine Optimization: getting your facts quoted inside the answer an AI writes (ChatGPT, Perplexity, Google AI overviews), rather than just ranking a link. SEO competes for a click; GEO competes to be the sentence the AI says.
Read the explainer →Related Answer engine · Entity · Crawler
An AI that writes a direct answer instead of returning a list of links — ChatGPT, Perplexity, Claude, Google’s AI overviews. To be cited, it has to trust you’re a real entity it can name.
Read the explainer →Related GEO · Crawler · Entity · Knowledge graph · Structured data
An automated bot that fetches and reads web pages to build a search or AI index — Googlebot, plus AI crawlers like GPTBot, ClaudeBot and PerplexityBot. Most don’t run JavaScript, so the page must ship full HTML.
Related Answer engine · GEO · Sitemap · IndexNow · User-Agent
An XML file listing every page on a site so search engines can find them all. We generate it at build, so it always lists every route and dynamic slug.
Related Crawler · IndexNow · Canonical URL · noindex · hreflang
The one official address you want a page indexed under. Without it, the same page reachable at two URLs splits its SEO credit between them.
Read the explainer →Related 301 redirect · hreflang · CNAME record · Sitemap
A “moved permanently” redirect that sends one URL to another and merges their SEO credit. We 301 the bare pangaea.id to the canonical www.pangaea.id.
Read the explainer →Related Canonical URL · HTTP status code
A tag that tells search engines which language/region version of a page to show, and which URLs are equivalents of each other (here: en, id and x-default).
Related Canonical URL · Sitemap
Machine-readable facts about a page (usually JSON-LD using schema.org types) — Organization, Person, FAQPage, BlogPosting — so search engines and AI can parse what the page is, not just read its words.
Read the explainer →Related JSON-LD · Entity · Knowledge graph · Wikidata · Answer engine
A real, specific thing an engine can name and trust — a company, a person — as opposed to a stray phrase. You become one through corroboration: the same facts agreeing across independent, trusted sources.
Read the explainer →Related Knowledge graph · Structured data · Wikidata · Answer engine · GEO
The open, machine-readable knowledge graph that engines treat as a truth anchor (no notability bar like Wikipedia). A sourced Wikidata item is one of the strongest entity signals you can create.
Read the explainer →Related Knowledge graph · Entity · Structured data
A protocol for instantly telling search engines (Bing, Yandex) which URLs changed, so they recrawl in minutes instead of waiting for the next crawl. We ping it automatically after each deploy.
Measuring traffic and attribution without persistent cookies — using sessionStorage and first-touch UTM instead — so it keeps working even when a visitor hasn’t consented to cookies.
Related Consent Mode
Google’s mechanism that keeps analytics storage denied by default until a visitor opts in, then unlocks it — so measurement respects consent instead of ignoring it.
Related Cookieless tracking