Backend

• REST design, routing, middleware and consistent error handling
• Request validation at the boundary, because the client cannot be trusted
• Environment configuration and keeping secrets out of the repository

Data

• Documents, collections and Mongoose schemas
• Embedding against referencing and the query patterns that decide it
• Indexes, the aggregation pipeline and the unbounded array anti-pattern

Frontend

• Components, props, state and hooks, with the dependency array as the usual bug
• Data fetching, loading and error states as first-class UI concerns
• Routing, forms and lifting state without rebuilding the app around it

Delivery

• Authentication with JWT or sessions, password hashing and the trade-offs
• Common vulnerabilities: injection, XSS, CORS misconfiguration
• Building, environment variables and deploying both halves of the application