Best Practices

"Your controller is the first code that touches every request and the last code before every response. Endpoints that work locally fail in production. Here's how to build APIs that scale."

The DBA noticed the prod connection string in a public GitHub commit. By lunch you were updating LinkedIn. Configuration is the boring infrastructure that ends careers — and it's not that hard to get right. Here's the playbook for IConfiguration, secrets, environments, and rotation.

A waiter who hands the ticket to the kitchen and works the floor can serve a full dining room. A waiter who stands at the kitchen window waiting for one dish starves everyone else. Your API makes the same choice every time you turn async code back into blocking code.

`new OrderService()` looks innocent. But now every test needs a real OrderService, a real database, and a real connection string. A test that should take 50ms takes 2 seconds and breaks when the DB blinks. Dependency injection isn't framework magic — it's a habit.