Software engineering

Software engineering on Exponential: architecture, the request cycle, caching, testing and quality.

50 pages

Security engineering overview The security model of Exponential for engineers - access control through policies, output escaping, safe SQL, CSRF tokens, the secure defaults of 2026, the HTTP security layer, authentication and two-factor sign-in, the… AdministratorsDevelopersSoftware Engineers Software engineering
HTTP security: headers, CSP, request rules and proxies The HTTP security layer of Exponential - security headers from SecurityHeaders[], the Content Security Policy with modes, directives, nonces and reports, request rules that allow, deny, redirect or log after URL… AdministratorsDevelopersSoftware Engineers Software engineering
Authentication, sessions and two-factor sign-in How users and machines authenticate to Exponential - password storage and policy, the list of well-known passwords, lockout, session handlers and cookies, two-factor sign-in with sevenx_authentication_2fa, OAuth 2.0 and… AdministratorsDevelopersSoftware Engineers Software engineering
Security review checklist A checklist for reviewing a change to Exponential or an extension for security - access control, input and output, SQL and shell, CSRF, files and uploads, redirects, secrets, logging and privacy, HTTP headers and CSP… DevelopersSoftware Engineers Software engineering
API design: REST, ezjscore and headless The interfaces Exponential offers to other systems and front ends - the REST content API of ezprestapi at v1 and v2, OAuth 2.0 and personal API keys, the ezjscore call interface and expservices, outgoing audit webhooks… DevelopersSoftware Engineers Software engineering
Git workflow How Git is used for Exponential - main as the one development line, branches and pull requests squashed and rebased while open, merge commits, no history rewriting after a merge, commit subjects with Added, Updated… DevelopersSoftware Engineers Software engineering
Contributing upstream How an engineer sends a change to the Exponential kernel or one of its extensions - forking and branching, the checks to run first, the copyright assignment (CLA) required for kernel contributions and what it means… DevelopersSoftware Engineers Software engineering
Documentation as code How Exponential treats its documentation like code - Markdown files in doc/ versioned with the kernel, served by the help system inside the administration, front matter that drives audiences and search, a link and image… DevelopersSoftware Engineers Software engineering
Software engineer FAQ Short answers to the questions software engineers ask first about Exponential - language and versions, frameworks and PSRs, ORM and migrations, databases, servers, statics, caches, tests, releases, security reports… DevelopersSoftware Engineers Software engineering
Glossary for software engineers The Exponential terms a software engineer meets, from audit trail and baseline to zygote, each defined in one or two sentences with the page that explains it, and mapped to the nearest term of other frameworks where one… DevelopersSoftware Engineers Software engineering

Documentation license

This documentation is free documentation, licensed under the GNU Free Documentation License 1.3 or later.