OutSystems Tech Lead flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Module layering rule

UI modules may reference Core and Logic modules, but Core and Logic modules must never reference UI modules. A reverse reference creates a cycle and breaks independent deployment.

Service module

A module type whose public actions and entities are exposed as REST or SOAP endpoints. Only Service modules should expose APIs; their public elements form a versioned contract.

Client action limits

Client actions execute in the browser, so they cannot safely hold secrets or call server-side entities directly. Any sensitive logic belongs in a server action instead.

BPT process definition

A Business Process Technology flow built from Human Activity, Automatic Activity, Decision, Wait, and End nodes. Each running instance is persisted and can be tracked and audited.

Static entity

A platform entity holding fixed reference records defined at design time, such as status codes or country lists. It is deployed with the module and read without database writes.

Screen state placement

Screens should stay stateless. Persistent state belongs in session variables, client variables such as Local Storage, or server entities, not only in prepared screen inputs.

Deployment plan

The LifeTime mechanism that promotes a tagged application version from one environment to the next. Direct cross-environment publishing bypasses the audit trail and rollback path.

Environment promotion chain

The standard sequence Development, QA or Test, Pre-Production, then Production. Each environment is registered in LifeTime and receives code only through a deployment plan.

Impact analysis before publish

A platform check listing modules and consumers affected by a change. Running it before publishing catches breaking public-element changes and is part of the Definition of Done.

Story sizing heuristic

Keep each user story inside one module and one developer. Shared module edits across parallel developers cause merge conflicts in the shared module model.

Version tagging convention

Tag the application version at every promotion, for example v1.4.0-QA. Tags make rollback targets unambiguous and tie deployed code to a known build.

Integration risk flag

Any external integration lacking a mock or contract test is a delivery risk. It must be listed at sprint planning and timeboxed early because it carries high uncertainty.

Module ownership model

Assign each module to one developer or pair. Shared ownership of a single module is the most common source of lost work and conflicting publishes.

Role check enforcement

Authorization must be enforced in server actions and screen role properties. Client-side role checks only affect user experience and are bypassable by a determined user.

Credential storage rule

Never build a custom credential store in entities. Use the platform Users and Roles model or an external identity provider through SAML or OIDC.

SQL injection defense

Use platform aggregates and parameterized SQL. Dynamic SQL assembled by string concatenation is a finding regardless of any input validation applied elsewhere.

Secret placement

Store API keys and tokens in platform secure settings or a secrets manager. Module constants and client variables are visible and must never hold secrets.

Least privilege roles

Define roles per business function rather than per screen. Audit role assignments every release because role drift accumulates and is a common audit finding.

Security event logging

Log login failures and permission denials from server actions. Never log full tokens or passwords, since logs are broadly readable by operators and developers.

Forge component review

Third-party Forge components must be checked for requested permissions and maintenance status before entering a production application. Unreviewed dependencies are a security risk.

Aggregate filtering rule

Fetch only needed attributes and filter on indexed attributes. An unfiltered aggregate over a large entity is the most common performance defect in OutSystems applications.

N+1 query pattern

A loop running an aggregate or server action per iteration. Replace it with one aggregate plus an in-memory join to cut round trips dramatically.

Cache invalidation requirement

Cache reference data only with a defined invalidation trigger. A cache without invalidation is a defect, because stale data reaches users with no recovery path.

Timeout classification

Distinguish client timeout, server request timeout, and integration timeout. Each has a separate configuration surface, so misclassifying the timeout sends fixes to the wrong layer.

Troubleshooting sequence

Reproduce in QA, read the error log in Service Center or LifeTime, then inspect the specific action stack trace. This order avoids guessing at causes.

List pagination threshold

Paginate or lazy-load lists above roughly fifty rows. Loading large lists on initial screen render is a frequent cause of slow perceived performance.

Performance budget

A target response time defined per screen and per API action at design time, then measured in QA with realistic data volume. It makes performance regressions visible early.

LifeTime role separation

IT Manager, Developer, and Operator permissions are distinct. Developers should not hold production deployment rights, which enforces a second pair of eyes on releases.

Hotfix promotion path

Hotfixes follow the same deployment path as normal changes: fixed in Development, promoted through QA, then Production. Skipping stages desynchronizes environments.

Code review gate

A change touching a public element or shared library requires review by the module owner plus one consumer owner. This catches contract breaks before they reach consumers.

Technical debt sweep

Each quarter, track unused public elements and orphan modules, then delete or deprecate them with a migration note. Undocumented public surface grows silently otherwise.

Access audit cadence

Review user roles, integration credentials, and environment access every release cycle rather than annually. Frequent review limits the blast radius of stale permissions.