diff --git a/docs/topics/backend.md b/docs/topics/backend.md
index 4ccf095..8bef518 100644
--- a/docs/topics/backend.md
+++ b/docs/topics/backend.md
@@ -8,183 +8,183 @@ What experienced backend engineers forget before an interview, grouped by subtop
 
 | Codes | Meaning |
 |---|---|
-| **401** vs **403** | missing or invalid credentials (re-auth may help) vs refused — credentials, if sent, are insufficient; others might succeed (or 404 to hide that the resource exists) |
-| **409** vs **422** | conflicts with current state vs well-formed but fails validation |
-| 202 / 204 | accepted for async processing / success with no body |
-| 412 / 429 | precondition (`If-Match`) failed / rate limited |
+| [401](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.2) vs [403](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.4) | missing or invalid credentials (re-auth may help) vs refused — credentials, if sent, are insufficient; others might succeed (or 404 to hide that the resource exists) |
+| [409](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.10) vs [422](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.21) | conflicts with current state vs well-formed but fails validation |
+| [202](https://www.rfc-editor.org/rfc/rfc9110#section-15.3.3) / [204](https://www.rfc-editor.org/rfc/rfc9110#section-15.3.5) | accepted for async processing / success with no body |
+| [412](https://www.rfc-editor.org/rfc/rfc9110#section-15.5.13) / [429](https://www.rfc-editor.org/rfc/rfc6585#section-4) | precondition (`If-Match`) failed / rate limited |
 
 ### Method semantics
 
-| Method | Safe | Idempotent |
+| Method | [Safe](https://www.rfc-editor.org/rfc/rfc9110#section-9.2.1) | [Idempotent](https://www.rfc-editor.org/rfc/rfc9110#section-9.2.2) |
 |---|---|---|
 | GET, HEAD | yes | yes |
-| PUT, DELETE | no | **yes** |
+| PUT, DELETE | no | yes |
 | POST | no | no |
-| PATCH | no | not guaranteed — depends on the patch format |
+| [PATCH](https://www.rfc-editor.org/rfc/rfc5789) | no | not guaranteed — depends on the patch format |
 
 ### PATCH formats
 
-- **JSON Merge Patch** (RFC 7396): send a partial object; `null` deletes a field — so it can't set a value to null or edit one array element.
-- **JSON Patch** (RFC 6902): a list of operations (`add`, `remove`, `replace`, `test`) on JSON Pointer paths; `test` makes the patch conditional.
+- [JSON Merge Patch](https://www.rfc-editor.org/rfc/rfc7396) (RFC 7396): send a partial object; `null` deletes a field — so it can't set a value to null or edit one array element.
+- [JSON Patch](https://www.rfc-editor.org/rfc/rfc6902) (RFC 6902): a list of operations (`add`, `remove`, `replace`, `test`) on [JSON Pointer](https://www.rfc-editor.org/rfc/rfc6901) paths; `test` makes the patch conditional.
 
 ### REST vs gRPC vs GraphQL
 
-| | REST | gRPC | GraphQL |
+| | [REST](https://en.wikipedia.org/wiki/REST) | [gRPC](https://grpc.io/docs/what-is-grpc/introduction/) | [GraphQL](https://graphql.org/learn/) |
 |---|---|---|---|
-| Contract | OpenAPI (optional) | **Protobuf**, strict | schema, strict |
-| Transport | any HTTP version | **HTTP/2** only | usually HTTP POST |
+| Contract | [OpenAPI](https://spec.openapis.org/oas/latest.html) (optional) | [Protobuf](https://protobuf.dev/overview/), strict | schema, strict |
+| Transport | any HTTP version | [HTTP/2](https://www.rfc-editor.org/rfc/rfc9113) only | usually HTTP POST |
 | Strength | HTTP caching, simplicity | streaming, speed, codegen | client picks fields, one round trip |
-| Weakness | over/under-fetching | browsers need gRPC-Web | hard to cache, N+1, query-cost limits |
+| Weakness | over/under-fetching | browsers need [gRPC-Web](https://grpc.io/docs/platforms/web/) | hard to cache, N+1, query-cost limits |
 
 ### Pagination
 
-- **Keyset**: `WHERE (created_at, id) > (:c, :id) ORDER BY ... LIMIT n` — fast at any depth and unaffected by inserts; needs a unique, immutable sort key, or updated rows skip or repeat.
-- Expose the position as an opaque **cursor**; a cursor is just a token and can also encode an offset.
-- **Offset**: simple and jumps to page N, but slows with depth and skips or repeats rows as data changes.
+- [Keyset](https://use-the-index-luke.com/no-offset): `WHERE (created_at, id) > (:c, :id) ORDER BY ... LIMIT n` — fast at any depth and unaffected by inserts; needs a unique, immutable sort key, or updated rows skip or repeat.
+- Expose the position as an opaque cursor; a cursor is just a token and can also encode an offset.
+- [Offset](https://www.postgresql.org/docs/current/queries-limit.html): simple and jumps to page N, but slows with depth and skips or repeats rows as data changes.
 
 ### Versioning
 
-- URI (`/v1/`) is explicit and cacheable; a header (`Accept: ...;version=2`) keeps URLs clean but is harder to discover.
-- Whatever the scheme: **additive changes only** within a version; removing or renaming a field is a breaking change.
+- URI (`/v1/`) is explicit and cacheable; a header ([`Accept: ...;version=2`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Accept)) keeps URLs clean but is harder to discover.
+- Whatever the scheme: additive changes only within a version; removing or renaming a field is a breaking change.
 
 ### Error responses
 
-- One error shape everywhere — **RFC 9457 problem details** (`type`, `title`, `status`, `detail`).
+- One error shape everywhere — [RFC 9457 problem details](https://www.rfc-editor.org/rfc/rfc9457) (`type`, `title`, `status`, `detail`).
 - Never return stack traces or SQL; log details server-side and return a request ID.
 
 ## Idempotency and concurrency
 
 ### Idempotency keys
 
-- The client sends a unique key per logical operation; the server stores the key with the **first result** and returns it on every retry.
-- Handle the **in-flight** case: a retry arriving while the first attempt is running must wait or get 409, not execute twice.
+- The client sends a unique [`Idempotency-Key`](https://datatracker.ietf.org/doc/draft-ietf-httpapi-idempotency-key-header/) per logical operation; the server stores the key with the first result and returns it on every retry.
+- Handle the in-flight case: a retry arriving while the first attempt is running must wait or get 409, not execute twice.
 - Scope keys per client and expire them after a TTL (e.g. 24 h).
 
 ### Optimistic concurrency with ETags
 
-- `GET` returns an **`ETag`**; the client sends `PUT` with **`If-Match: <etag>`**, and the server answers **412** if the resource changed — no lost updates between clients.
-- `If-Match` needs a strong ETag (not `W/`); `If-None-Match: *` makes a `PUT` create-only.
+- `GET` returns an [`ETag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag); the client sends `PUT` with [`If-Match: <etag>`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-Match), and the server answers 412 if the resource changed — no lost updates between clients.
+- `If-Match` needs a [strong ETag](https://www.rfc-editor.org/rfc/rfc9110#section-8.8.1) (not `W/`); [`If-None-Match: *`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-None-Match) makes a `PUT` create-only.
 
 ### Transactional outbox
 
-- Write the business row and an outbox row in the **same DB transaction**; a relay (poller or CDC) publishes outbox rows and marks them sent.
-- Fixes the dual-write problem without 2PC, which most brokers don't support. Delivery is at-least-once.
+- Write the business row and an outbox row in the same DB transaction; a relay (poller or [CDC](https://en.wikipedia.org/wiki/Change_data_capture)) publishes outbox rows and marks them sent — the [transactional outbox](https://microservices.io/patterns/data/transactional-outbox.html).
+- Fixes the dual-write problem without [2PC](https://en.wikipedia.org/wiki/Two-phase_commit_protocol), which most brokers don't support. Delivery is at-least-once (see [distributed.md](distributed.md)).
 
 ### Inbox deduplication
 
-- Consumers record processed message IDs **in the same transaction** as their effect and skip repeats — the receiving side of the outbox.
+- Consumers record processed message IDs in the same transaction as their effect and skip repeats — the receiving side of the outbox ([idempotent consumer](https://microservices.io/patterns/communication-style/idempotent-consumer.html)).
 - Expire entries only after the broker's maximum redelivery window.
 
 ## Service calls
 
 ### Timeouts and deadline propagation
 
-- Every outbound call gets a **timeout**, shorter than the caller's own.
-- **Propagate the deadline** (gRPC does it natively) so downstream services stop work once the original caller has given up.
+- Every outbound call gets a timeout, shorter than the caller's own.
+- Propagate the deadline so downstream services stop work once the original caller has given up — [gRPC](https://grpc.io/docs/guides/deadlines/) sends it on the wire, but each server must pass it on to its outbound calls and honor cancellation.
 - Retries, backoff, and circuit breakers: see [distributed.md](distributed.md).
 
 ### Schema evolution
 
-- **Backward compatible**: new readers read old data; **forward compatible**: old readers read new data — rolling deploys and replayed events need both.
-- Protobuf: never reuse or renumber a field tag (mark removed ones `reserved`); adding fields is safe; proto3 has no `required`; unknown fields survive a round trip.
-- Avro with a schema registry checks BACKWARD, FORWARD, or FULL compatibility on every schema change.
-- JSON consumers must ignore unknown fields (**tolerant reader**); rename a field by adding the new one, writing both, moving readers over, then removing the old.
+- [Backward compatible](https://en.wikipedia.org/wiki/Backward_compatibility): new readers read old data; [forward compatible](https://en.wikipedia.org/wiki/Forward_compatibility): old readers read new data — rolling deploys and replayed events need both.
+- [Protobuf](https://protobuf.dev/programming-guides/proto3/#updating): never reuse or renumber a field tag (mark removed ones [`reserved`](https://protobuf.dev/programming-guides/proto3/#reserved)); adding fields is safe; proto3 has no `required`; unknown fields survive a binary round trip, but not conversion to JSON.
+- [Avro](https://avro.apache.org/docs/) with a [schema registry](https://docs.confluent.io/platform/current/schema-registry/fundamentals/schema-evolution.html) checks BACKWARD, FORWARD, or FULL compatibility on every schema change.
+- JSON consumers must ignore unknown fields ([tolerant reader](https://martinfowler.com/bliki/TolerantReader.html)); rename a field by adding the new one, writing both, moving readers over, then removing the old.
 
 ### Webhooks
 
-- **Sign** each payload (HMAC over timestamp + body) and have receivers verify it with a **constant-time** compare; reject stale timestamps to stop replays.
-- Deliver **at least once** with backoff, so receivers dedupe by event ID; receivers should ack fast (2xx) and process asynchronously.
-- Fetching a user-supplied webhook URL is an SSRF risk — see [security.md](security.md).
+- Sign each payload ([HMAC](https://en.wikipedia.org/wiki/HMAC) over timestamp + body) and have receivers verify it with a [constant-time](https://en.wikipedia.org/wiki/Timing_attack) compare; reject stale timestamps to stop replays.
+- Deliver at least once with backoff, so receivers dedupe by event ID; receivers should ack fast (2xx) and process asynchronously.
+- Fetching a user-supplied webhook URL is an [SSRF](https://community.owasp.org/attacks/Server_Side_Request_Forgery) risk — see [security.md](security.md).
 
 ## Async work
 
 ### Long-running operations
 
-- Return **202 Accepted** with a `Location` to a status resource (`/operations/123`); the client polls it or gets a webhook when done.
-- The status resource carries state (`pending`, `running`, `succeeded`, `failed`) and the result or error.
+- Return [202 Accepted](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/202) with a [`Location`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Location) to a status resource (`/operations/123`); the client polls it or gets a webhook when done.
+- The status resource carries state (`pending`, `running`, `succeeded`, `failed`) and the result or error ([asynchronous request-reply](https://learn.microsoft.com/en-us/azure/architecture/patterns/asynchronous-request-reply)).
 
 ### Background jobs
 
-- At-least-once delivery means jobs must be **idempotent**; persistently failing jobs go to a **dead-letter queue** with alerting.
+- At-least-once delivery means jobs must be [idempotent](https://en.wikipedia.org/wiki/Idempotence); persistently failing jobs go to a [dead-letter queue](https://en.wikipedia.org/wiki/Dead_letter_queue) with alerting.
 - Give every job a timeout; long jobs checkpoint progress so a retry resumes instead of restarting.
 
 ### Scheduled jobs
 
-- Guard against **overlapping runs**, where one run lasts longer than the interval.
-- With several replicas, each fires the same cron — use a lock (DB row, advisory lock, lease) or a single scheduler.
+- Guard against overlapping runs, where one run lasts longer than the interval.
+- With several replicas, each fires the same [cron](https://en.wikipedia.org/wiki/Cron) — use a lock (DB row, [advisory lock](https://www.postgresql.org/docs/current/explicit-locking.html#ADVISORY-LOCKS), [lease](https://en.wikipedia.org/wiki/Lease_%28computer_science%29)) or a single scheduler.
 
 ## Data access
 
 ### N+1 queries
 
-- Loading a list, then one query per item. Fix with a `JOIN`, a batched `WHERE id IN (...)`, or a **DataLoader** that batches lookups per tick (GraphQL resolvers).
-- Spot it with per-request query counts in logs or APM.
+- Loading a list, then one query per item. Fix with a `JOIN`, a batched `WHERE id IN (...)`, or a [DataLoader](https://github.com/graphql/dataloader) that batches lookups per tick (GraphQL resolvers).
+- Spot it with per-request query counts in logs or [APM](https://en.wikipedia.org/wiki/Application_performance_management).
 
 ### Connection pool sizing
 
-- Size the pool from the **database's** capacity, not the app's thread count — many app instances × a large pool overwhelm the database.
-- A good starting point is a small pool per instance (~2× DB cores total across instances), then measure wait time.
+- Size the [connection pool](https://en.wikipedia.org/wiki/Connection_pool) from the database's capacity, not the app's thread count — many app instances × a large pool overwhelm the database.
+- A good starting point is a small pool per instance (~2× DB cores total across instances, [HikariCP's formula](https://github.com/brettwooldridge/HikariCP/wiki/About-Pool-Sizing)), then measure wait time; see [database.md](database.md).
 
 ### Transaction boundaries
 
-- Never make a network call inside an open DB transaction — it holds **locks and a connection** for the whole round trip.
-- For "commit, then notify another service", use the outbox instead of calling inside the transaction.
+- Never make a network call inside an open DB transaction — it holds locks and a connection for the whole round trip.
+- For "commit, then notify another service", use the [outbox](https://microservices.io/patterns/data/transactional-outbox.html) instead of calling inside the transaction.
 
 ### Multi-tenancy models
 
-- Shared tables with a `tenant_id`: cheapest, but every query must filter — enforce it with PostgreSQL **row-level security** (the table owner bypasses it unless `FORCE ROW LEVEL SECURITY`).
+- Shared tables with a `tenant_id`: cheapest, but every query must filter — enforce it with PostgreSQL [row-level security](https://www.postgresql.org/docs/current/ddl-rowsecurity.html) (the table owner bypasses it unless [`FORCE ROW LEVEL SECURITY`](https://www.postgresql.org/docs/current/sql-altertable.html)).
 - Schema per tenant: more isolation, but migrations and connection pools multiply with the tenant count.
 - Database per tenant: strongest isolation, per-tenant restore and data residency, the most operational work.
-- Move **noisy neighbors** (the largest tenants) to their own shard or database, and rate-limit per tenant.
+- Move [noisy neighbors](https://learn.microsoft.com/en-us/azure/architecture/antipatterns/noisy-neighbor/noisy-neighbor) (the largest tenants) to their own shard or database, and rate-limit per tenant.
 
 ### Time handling
 
-- Store and send instants in **UTC** (RFC 3339 with an offset, `2026-03-08T09:30:00Z`); in PostgreSQL use `timestamptz`.
-- For future local-time events (meetings, schedules), store the local time plus an **IANA zone** (`Europe/Berlin`), not an offset — DST rules and offsets change.
-- A DST switch skips or repeats a local hour, so a job scheduled at 02:30 local time runs never or twice; schedule jobs in UTC.
+- Store and send instants in UTC ([RFC 3339](https://www.rfc-editor.org/rfc/rfc3339) with an offset, `2026-03-08T09:30:00Z`); in PostgreSQL use [`timestamptz`](https://www.postgresql.org/docs/current/datatype-datetime.html).
+- For future local-time events (meetings, schedules), store the local time plus an [IANA zone](https://www.iana.org/time-zones) (`Europe/Berlin`), not an offset — DST rules and offsets change.
+- A [DST](https://en.wikipedia.org/wiki/Daylight_saving_time) switch skips or repeats a local hour, so a job scheduled at 02:30 local time runs never or twice; schedule jobs in UTC.
 
 ### File uploads
 
-- Clients upload straight to object storage with a presigned URL, bypassing app servers ([system.md](system.md)).
-- **Multipart/resumable uploads** retry individual parts instead of the whole file.
+- Clients upload straight to object storage with a [presigned URL](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html), bypassing app servers ([system.md](system.md)).
+- [Multipart](https://docs.aws.amazon.com/AmazonS3/latest/userguide/mpuoverview.html) or [resumable](https://tus.io/protocols/resumable-upload) uploads retry individual parts instead of the whole file.
 
 ## Service lifecycle
 
 ### Graceful shutdown
 
-- On **`SIGTERM`**: fail readiness → stop accepting new connections → finish in-flight requests within a deadline → close pools and flush telemetry → exit.
+- On [`SIGTERM`](https://man7.org/linux/man-pages/man7/signal.7.html): fail readiness → stop accepting new connections → finish in-flight requests within a deadline → close pools and flush telemetry → exit.
 - Workers stop pulling jobs and finish or checkpoint the current one. Kubernetes timing: see [devops.md](devops.md).
 
 ### Health endpoints
 
-- Separate endpoints: **liveness** checks only that the process can make progress; **readiness** checks what serving needs (warm-up done, required dependencies) and fails while draining.
+- Separate endpoints: [liveness](https://kubernetes.io/docs/concepts/workloads/pods/probes/) checks only that the process can make progress; readiness checks what serving needs (warm-up done, required dependencies) and fails while draining.
 - Keep them cheap and on an internal port; probe configuration and pitfalls: see [devops.md](devops.md).
 
 ## Backend security
 
 ### Mass assignment
 
-- Binding the request body straight onto a model lets clients set `isAdmin: true` — **allowlist** bindable fields or use separate DTOs.
+- Binding the request body straight onto a model lets clients set `isAdmin: true` ([mass assignment](https://cheatsheetseries.owasp.org/cheatsheets/Mass_Assignment_Cheat_Sheet.html)) — allowlist bindable fields or use separate [DTOs](https://martinfowler.com/eaaCatalog/dataTransferObject.html).
 - Serialize responses through explicit DTOs too, so a new sensitive column doesn't leak.
 
 ### Input validation
 
-- Validate type, format, and range at the boundary before business logic (**400**); business-rule failures come later (409/422).
-- Cap sizes — body, array lengths, string lengths, nesting depth — to prevent resource exhaustion.
+- [Validate](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html) type, format, and range at the boundary before business logic (400); business-rule failures come later (409/422).
+- Cap sizes — body, array lengths, string lengths, nesting depth — to prevent [resource exhaustion](https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption/).
 
 ### Secrets in logs
 
-- Request logging middleware can capture tokens, auth headers, and PII — **redact centrally** in the logging layer, not per call site.
+- Request logging middleware can capture tokens, auth headers, and [PII](https://en.wikipedia.org/wiki/Personal_data) — redact centrally in the logging layer, not per call site ([OWASP logging](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)).
 - Tokens in URL query strings end up in proxy and CDN logs — send them in headers.
 
 ## Testing
 
 ### Integration tests with real dependencies
 
-- **Testcontainers** runs real dependencies (Postgres, Kafka) in tests, catching SQL and serialization bugs that mocks hide.
-- A mock only checks your assumptions about a dependency; test the real one at least at the adapter boundary.
+- [Testcontainers](https://testcontainers.com/) runs real dependencies (Postgres, Kafka) in tests, catching SQL and serialization bugs that mocks hide.
+- A [mock](https://martinfowler.com/articles/mocksArentStubs.html) only checks your assumptions about a dependency; test the real one at least at the adapter boundary.
 
 ### Consumer-driven contract tests
 
-- **Consumer-driven contract tests** (Pact): each consumer records the requests and fields it relies on, and the provider's CI verifies them.
+- [Consumer-driven contract tests](https://martinfowler.com/articles/consumerDrivenContracts.html) ([Pact](https://docs.pact.io/)): each consumer records the requests and fields it relies on, and the provider's CI verifies them.
 - Catches breaking API changes without deploying both services together.
diff --git a/docs/topics/frontend.md b/docs/topics/frontend.md
index 01abce6..fb4665c 100644
--- a/docs/topics/frontend.md
+++ b/docs/topics/frontend.md
@@ -8,69 +8,69 @@ What experienced frontend engineers forget before an interview, grouped by subto
 
 | Strategy | Renders | Trade-off |
 |---|---|---|
-| CSR | in the browser after JS loads | slow first paint and SEO, fast later navigation |
-| SSR | on the server, per request | fresh and SEO-friendly, higher server load |
-| SSG | at build time | fastest and cheapest, stale until rebuild |
-| ISR | like SSG, regenerated in the background after a revalidate interval or on demand | near-CDN speed; serves stale until regeneration succeeds |
+| [CSR](https://web.dev/articles/rendering-on-the-web#client-side) | in the browser after JS loads | slow first paint and SEO, fast later navigation |
+| [SSR](https://web.dev/articles/rendering-on-the-web#server-side) | on the server, per request | fresh and SEO-friendly, higher server load |
+| [SSG](https://web.dev/articles/rendering-on-the-web#static) | at build time | fastest and cheapest, stale until rebuild |
+| [ISR](https://nextjs.org/docs/app/guides/incremental-static-regeneration) | like SSG, regenerated in the background after a revalidate interval or on demand | near-CDN speed; serves stale until regeneration succeeds |
 
 ### Streaming SSR and hydration
 
-- **Streaming SSR** flushes HTML in chunks, so the shell paints before slow data-dependent sections resolve.
-- **Hydration** runs the render on the client and attaches listeners to the server HTML, reusing the DOM instead of recreating it.
-- A **hydration mismatch** (server and client render different output) can force the framework to re-render that part on the client — React's causes and fixes in [react.md](react.md).
+- [Streaming SSR](https://react.dev/reference/react-dom/server/renderToPipeableStream) flushes HTML in chunks, so the shell paints before slow data-dependent sections resolve.
+- [Hydration](https://en.wikipedia.org/wiki/Hydration_%28web_development%29) runs the render on the client and attaches listeners to the server HTML, reusing the DOM instead of recreating it.
+- A hydration mismatch (server and client render different output) can force the framework to re-render that part on the client — React's causes and fixes in [react.md](react.md).
 
 ### Islands and Server Components
 
-- **Islands architecture**: the page is static HTML; only interactive islands ship JS and hydrate independently.
-- **React Server Components** render only on the server and send serialized output, not code — only Client Components ship JS and hydrate (see [react.md](react.md)).
+- [Islands architecture](https://docs.astro.build/en/concepts/islands/): the page is static HTML; only interactive islands ship JS and hydrate independently.
+- [React Server Components](https://react.dev/reference/rsc/server-components) render only on the server and send serialized output, not code — only Client Components ship JS and hydrate (see [react.md](react.md)).
 
 ### Client-side routing
 
-- The router intercepts navigation and updates the URL with the **History API** (`pushState`), no full reload.
-- A refresh on `/profile` hits the **server**, which must fall back to `index.html` for unknown paths or it 404s.
+- The router intercepts navigation and updates the URL with the [History API](https://developer.mozilla.org/en-US/docs/Web/API/History_API) ([`pushState`](https://developer.mozilla.org/en-US/docs/Web/API/History/pushState)), no full reload.
+- A refresh on `/profile` hits the server, which must fall back to `index.html` for unknown paths or it 404s.
 
 ## Browser pipeline
 
 ### Critical rendering path
 
-- HTML → DOM, CSS → CSSOM → **render tree** (visible nodes) → layout → paint → composite.
-- CSS is **render-blocking**; a classic `<script>` is **parser-blocking**.
+- HTML → [DOM](https://developer.mozilla.org/en-US/docs/Web/API/Document_Object_Model), CSS → [CSSOM](https://developer.mozilla.org/en-US/docs/Web/API/CSS_Object_Model) → render tree (visible nodes) → layout → paint → composite ([critical rendering path](https://developer.mozilla.org/en-US/docs/Web/Performance/Guides/Critical_rendering_path)).
+- CSS is [render-blocking](https://developer.mozilla.org/en-US/docs/Glossary/Render_blocking); a classic `<script>` is parser-blocking.
 
 ### Script loading: async, defer, module
 
-- **`async`**: downloads in parallel, runs as soon as it arrives, no order guarantee.
-- **`defer`**: downloads in parallel, runs in order after parsing; `type="module"` is deferred by default.
+- [`async`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script#async): downloads in parallel, runs as soon as it arrives, no order guarantee.
+- [`defer`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/script#defer): downloads in parallel, runs in order after parsing; [`type="module"`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Modules#other_differences_between_modules_and_classic_scripts) is deferred by default.
 
 ### Compositor-only animation
 
-- Changing `width`/`top` re-runs layout + paint + composite; **`transform`/`opacity`** can skip to composite on the GPU once the element has its own layer.
-- `will-change: transform` promotes a layer ahead of time; too many layers waste GPU memory.
+- Changing `width`/`top` re-runs layout + paint + composite; `transform`/`opacity` can skip to [composite on the GPU](https://web.dev/articles/stick-to-compositor-only-properties-and-manage-layer-count) once the element has its own layer.
+- [`will-change: transform`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/will-change) hints the browser to promote a layer ahead of time; too many layers waste GPU memory.
 
 ### Layout thrashing
 
-- Alternating reads (`offsetHeight`) and writes (`style.width`) in a loop forces a **synchronous reflow** each time.
-- Batch all reads, then all writes — or schedule writes in `requestAnimationFrame`.
+- Alternating reads ([`offsetHeight`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/offsetHeight)) and writes (`style.width`) in a loop forces a [synchronous reflow](https://web.dev/articles/avoid-large-complex-layouts-and-layout-thrashing#avoid_forced_synchronous_layouts) each time.
+- Batch all reads, then all writes — or schedule writes in [`requestAnimationFrame`](https://developer.mozilla.org/en-US/docs/Web/API/Window/requestAnimationFrame).
 
 ## CSS
 
 ### Specificity and the cascade
 
-- **Specificity**: inline > ID > class/attribute/pseudo-class > element; cascade layers and origin rank above specificity, and `!important` inverts layer order.
+- [Specificity](https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Cascade/Specificity): inline > ID > class/attribute/pseudo-class > element; [cascade layers](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@layer) and [origin](https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Cascade/Introduction#origin_types) rank above specificity, and [`!important`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Values/important) inverts layer order.
 
 ### Stacking contexts
 
-- `z-index` only compares elements **within the same stacking context** — why `z-index: 9999` sometimes "doesn't work".
+- [`z-index`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/z-index) only compares elements within the same [stacking context](https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Positioned_layout/Stacking_context) — why `z-index: 9999` sometimes "doesn't work".
 - `opacity < 1`, `transform`, `filter`, `position: fixed`, and positioned elements with a `z-index` each create a new context.
 
 ### Modern CSS features
 
-- **Container queries** (`@container`) style a component by its container's size, not the viewport — reusable responsive components.
-- **`:has()`** selects a parent by its children (`form:has(:invalid)`), which used to need JavaScript.
+- [Container queries](https://developer.mozilla.org/en-US/docs/Web/CSS/Guides/Containment/Container_queries) (`@container`) style a component by its container's size, not the viewport — reusable responsive components.
+- [`:has()`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/:has) selects a parent by its children (`form:has(:invalid)`), which used to need JavaScript.
 
 ### View transitions
 
-- **View Transitions API** animates between two DOM states: `document.startViewTransition(update)` snapshots old and new, then cross-fades or morphs elements sharing a `view-transition-name`.
-- Multi-page apps opt in to cross-document transitions with `@view-transition { navigation: auto }`.
+- The [View Transition API](https://developer.mozilla.org/en-US/docs/Web/API/View_Transition_API) animates between two DOM states: [`document.startViewTransition(update)`](https://developer.mozilla.org/en-US/docs/Web/API/Document/startViewTransition) snapshots old and new, then cross-fades or morphs elements sharing a [`view-transition-name`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/view-transition-name).
+- Multi-page apps opt in to cross-document transitions with [`@view-transition { navigation: auto }`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@view-transition).
 
 ## Performance
 
@@ -78,79 +78,79 @@ What experienced frontend engineers forget before an interview, grouped by subto
 
 | Metric | Good at p75 | Measures |
 |---|---|---|
-| **LCP** | ≤ 2.5 s | render time of the largest visible element |
-| **INP** | ≤ 200 ms | worst-ish interaction latency over the visit; **replaced FID in March 2024** |
-| **CLS** | ≤ 0.1 | unexpected layout shift |
+| [LCP](https://web.dev/articles/lcp) | ≤ 2.5 s | render time of the largest visible element |
+| [INP](https://web.dev/articles/inp) | ≤ 200 ms | worst-ish interaction latency over the visit; [replaced FID in March 2024](https://web.dev/blog/inp-cwv-launch) |
+| [CLS](https://web.dev/articles/cls) | ≤ 0.1 | unexpected layout shift |
 
 ### Fixing Web Vitals
 
-- **LCP**: preload the hero image or font, cut render-blocking resources, fast TTFB.
-- **INP**: break long tasks (> **50 ms**) and yield to the main thread.
-- CLS: reserve space with `width`/`height` or `aspect-ratio`.
+- [LCP](https://web.dev/articles/optimize-lcp): [preload](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/preload) the hero image or font, cut render-blocking resources, fast [TTFB](https://web.dev/articles/ttfb).
+- [INP](https://web.dev/articles/optimize-inp): break [long tasks](https://developer.mozilla.org/en-US/docs/Glossary/Long_task) (> 50 ms) and yield to the main thread ([`scheduler.yield()`](https://developer.mozilla.org/en-US/docs/Web/API/Scheduler/yield)).
+- [CLS](https://web.dev/articles/optimize-cls): reserve space with `width`/`height` or [`aspect-ratio`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/aspect-ratio).
 
 ### Bundle size
 
-- **Code splitting** by route or with dynamic `import()` keeps the first bundle to what the first screen needs.
-- **Tree shaking** needs ES modules; `"sideEffects": false` also lets the bundler drop unused modules whole — list CSS and polyfill files as exceptions.
+- [Code splitting](https://developer.mozilla.org/en-US/docs/Glossary/Code_splitting) by route or with dynamic [`import()`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import) keeps the first bundle to what the first screen needs.
+- [Tree shaking](https://developer.mozilla.org/en-US/docs/Glossary/Tree_shaking) needs ES modules; [`"sideEffects": false`](https://webpack.js.org/guides/tree-shaking/#mark-the-file-as-side-effect-free) also lets the bundler drop unused modules whole — list CSS and polyfill files as exceptions.
 
 ### Images
 
-- **`srcset`/`sizes`** let the browser pick a resolution per viewport; AVIF/WebP are much smaller than JPEG/PNG.
-- `loading="lazy"` for below-the-fold images — never on the LCP image, which should get **`fetchpriority="high"`**.
+- [`srcset`/`sizes`](https://developer.mozilla.org/en-US/docs/Web/HTML/Guides/Responsive_images) let the browser pick a resolution per viewport; [AVIF/WebP](https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Formats/Image_types) are much smaller than JPEG/PNG.
+- [`loading="lazy"`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/img#loading) for below-the-fold images — never on the LCP image, which should get [`fetchpriority="high"`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/img#fetchpriority).
 
 ### Main-thread offloading
 
-- **Web Workers** run JS on another thread (no DOM access), talking via `postMessage` (structured clone, or transfer an `ArrayBuffer` for free).
-- **`content-visibility: auto`** skips layout and paint for off-screen sections.
+- [Web Workers](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API) run JS on another thread (no DOM access), talking via [`postMessage`](https://developer.mozilla.org/en-US/docs/Web/API/Worker/postMessage) ([structured clone](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Structured_clone_algorithm), or [transfer](https://developer.mozilla.org/en-US/docs/Web/API/Web_Workers_API/Transferable_objects) an `ArrayBuffer` for free).
+- [`content-visibility: auto`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Properties/content-visibility) skips layout and paint for off-screen sections.
 
 ### Resource hints
 
-- **`preload`**: fetch this exact resource now, it's needed for the current page.
-- **`prefetch`**: low-priority fetch for a likely next navigation.
-- **`preconnect`**: open DNS + TCP + TLS early when the resource URL isn't known yet.
+- [`preload`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/preload): fetch this exact resource now, it's needed for the current page.
+- [`prefetch`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/prefetch): low-priority fetch for a likely next navigation.
+- [`preconnect`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Attributes/rel/preconnect): open DNS + TCP + TLS early when the resource URL isn't known yet.
 
 ## Caching
 
 ### Cache-Control directives
 
-- **`no-cache`** means **revalidate every time**, not "don't cache"; `no-store` means never store.
-- `max-age` applies to every cache; **`s-maxage`** overrides it for shared caches (CDN).
+- [`no-cache`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#no-cache) means revalidate every time, not "don't cache"; [`no-store`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#no-store) means never store.
+- [`max-age`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#max-age) applies to every cache; [`s-maxage`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#s-maxage) overrides it for shared caches (CDN).
 
 ### Hashed assets and validators
 
-- Long `max-age` + `immutable` on **content-hashed filenames** (`app.a3f9c1.js`), with HTML served `no-cache` — each deploy is a new URL.
-- `ETag`/`Last-Modified` let the server answer **`304 Not Modified`** — saves the body, not the round trip.
+- Long `max-age` + [`immutable`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cache-Control#immutable) on content-hashed filenames (`app.a3f9c1.js`), with HTML served `no-cache` — each deploy is a new URL.
+- [`ETag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag)/[`Last-Modified`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Last-Modified) let the server answer [`304 Not Modified`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/304) — saves the body, not the round trip.
 
 ### Browser storage
 
 | Storage | Size | Notes |
 |---|---|---|
-| Cookies | ~4 KB each | sent with every request to the domain |
-| `localStorage` | ~5 MB per origin | **synchronous** (blocks the main thread), strings only |
-| `sessionStorage` | ~5 MB per origin | per tab, cleared when the tab closes |
-| **IndexedDB** | a share of free disk | async, structured data, available in workers |
-| Cache API | a share of free disk | request/response pairs, used by service workers |
+| [Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Cookies) | ~4 KB each | sent with every request to the domain |
+| [`localStorage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage) | ~5 MB per origin | synchronous (blocks the main thread), strings only |
+| [`sessionStorage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/sessionStorage) | ~5 MB per origin | per tab, cleared when the tab closes |
+| [IndexedDB](https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API) | a [share of total disk](https://developer.mozilla.org/en-US/docs/Web/API/Storage_API/Storage_quotas_and_eviction_criteria), per-origin quota | async, structured data, available in workers |
+| [Cache API](https://developer.mozilla.org/en-US/docs/Web/API/Cache) | same origin quota as IndexedDB | request/response pairs, used by service workers |
 
-Any XSS can read all of them except `HttpOnly` cookies — token storage in [security.md](security.md).
+Any [XSS](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS) can read all of them except [`HttpOnly`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#httponly) cookies — token storage in [security.md](security.md).
 
 ### Service workers
 
-- **Service workers** implement cache-first, network-first, or stale-while-revalidate strategies and offline support.
-- A waiting service worker is a common reason users keep seeing the old deploy.
+- [Service workers](https://developer.mozilla.org/en-US/docs/Web/API/Service_Worker_API) implement cache-first, network-first, or [stale-while-revalidate](https://web.dev/articles/offline-cookbook#stale-while-revalidate) strategies and offline support.
+- A [waiting service worker](https://web.dev/articles/service-worker-lifecycle#waiting) is a common reason users keep seeing the old deploy.
 
 ## Accessibility
 
 ### Semantic HTML and ARIA
 
 - Native elements (`<button>`, `<nav>`, `<label>`) come with keyboard, focus, and screen-reader behavior for free.
-- **First rule of ARIA**: don't use ARIA when a native element already has the semantics.
+- [First rule of ARIA](https://www.w3.org/TR/using-aria/#rule1): don't use [ARIA](https://developer.mozilla.org/en-US/docs/Web/Accessibility/ARIA) when a native element already has the semantics.
 
 ### Focus management in SPAs
 
-- Client-side navigation doesn't reset focus — **move focus** to the new view's heading on route change.
-- Everything clickable must be keyboard-reachable with a visible focus indicator; a `<dialog>` opened with `showModal()` makes the rest of the page inert.
+- Client-side navigation doesn't reset focus — move focus to the new view's heading on route change.
+- Everything clickable must be keyboard-reachable with a [visible focus indicator](https://www.w3.org/WAI/WCAG22/Understanding/focus-visible.html); a [`<dialog>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/dialog) opened with [`showModal()`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLDialogElement/showModal) makes the rest of the page [inert](https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/inert).
 
 ### Contrast
 
-- **WCAG AA**: **4.5:1** for normal text, **3:1** for large text and UI components.
-- Never convey information by color alone (error states need text or an icon).
+- [WCAG AA](https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html): 4.5:1 for normal text, 3:1 for large text and [UI components](https://www.w3.org/WAI/WCAG22/Understanding/non-text-contrast.html).
+- Never convey information by [color alone](https://www.w3.org/WAI/WCAG22/Understanding/use-of-color.html) (error states need text or an icon).
diff --git a/docs/topics/nextjs.md b/docs/topics/nextjs.md
index 0323b41..0457890 100644
--- a/docs/topics/nextjs.md
+++ b/docs/topics/nextjs.md
@@ -1,41 +1,42 @@
 # Next.js
 
-What experienced Next.js engineers forget before an interview, grouped by subtopic. Covers the App Router as of Next.js 16.3; React semantics (Server Components, Suspense, Actions) are in [react.md](react.md), and rendering strategies in general in [frontend.md](frontend.md).
+What experienced Next.js engineers forget before an interview, grouped by subtopic. Covers the App Router as of Next.js 16.4; React semantics (Server Components, Suspense, Actions) are in [react.md](react.md), and rendering strategies in general in [frontend.md](frontend.md).
 
 ## Rendering
 
 ### Static and dynamic rendering
 
-- Without Cache Components, a route is **prerendered at build** unless it reads request-time data: `cookies()`, `headers()`, `searchParams`, `connection()`, or `fetch` with `cache: 'no-store'`.
-- Since **Next.js 15** a plain `fetch` isn't cached, yet a route that only uses it is still prerendered — the build-time response stays in the HTML until revalidation; `await connection()` forces request time.
-- Segment configs choose explicitly: `export const dynamic = 'force-dynamic'`, `export const revalidate = 60` (ISR).
-- `generateStaticParams` prerenders chosen params; others render on first request unless `dynamicParams = false` makes them 404.
+- Without Cache Components, a route is prerendered at build unless it reads request-time data: [`cookies()`](https://nextjs.org/docs/app/api-reference/functions/cookies), [`headers()`](https://nextjs.org/docs/app/api-reference/functions/headers), [`searchParams`](https://nextjs.org/docs/app/api-reference/file-conventions/page#searchparams-optional), [`connection()`](https://nextjs.org/docs/app/api-reference/functions/connection), or [`fetch`](https://nextjs.org/docs/app/api-reference/functions/fetch) with `cache: 'no-store'`.
+- Since [Next.js 15](https://nextjs.org/blog/next-15) a plain `fetch` isn't cached, yet a route that only uses it is still prerendered — the build-time response stays in the HTML until revalidation; `await connection()` forces request time.
+- [Segment configs](https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config) choose explicitly: `export const dynamic = 'force-dynamic'`, `export const revalidate = 60` ([ISR](https://nextjs.org/docs/app/guides/incremental-static-regeneration)).
+- [`generateStaticParams`](https://nextjs.org/docs/app/api-reference/functions/generate-static-params) prerenders chosen params; others render on first request unless [`dynamicParams = false`](https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config/dynamicParams) makes them 404.
 
 ### Cache Components
 
-- **`cacheComponents: true`** (Next.js 16, replaces `experimental.ppr` and `dynamicIO`) makes everything dynamic by default; cache explicitly with `'use cache'`.
-- The build prerenders a **static shell** (Partial Prerendering); request-time data goes inside `<Suspense>` and streams into the same response, or gets cached — a page with no static shell fails the build.
-- In development, 16.3 validates that every navigation renders instantly and flags code that would block; `export const instant = false` accepts a blocking route.
+- [`cacheComponents: true`](https://nextjs.org/docs/app/api-reference/config/next-config-js/cacheComponents) (Next.js 16, replaces `experimental.ppr` and `dynamicIO`) makes everything dynamic by default; cache explicitly with [`'use cache'`](https://nextjs.org/docs/app/api-reference/directives/use-cache).
+- The build prerenders a static shell ([Partial Prerendering](https://nextjs.org/docs/app/glossary#partial-prerendering-ppr)); request-time data goes inside [`<Suspense>`](https://react.dev/reference/react/Suspense) and streams into the same response, or gets cached — a page with no static shell fails the build.
+- In development, 16.3 validates that every navigation renders instantly and flags code that would block; [`export const instant = false`](https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config/instant) accepts a blocking route, and on the highest segment also skips the static-shell check.
+- [`export const ensureStatic = 'navigation'`](https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config/ensureStatic) (16.4) fails the build if anything in the route would render at request time.
 - The `dynamic`, `revalidate`, `fetchCache`, and `dynamicParams` segment configs are errors under Cache Components.
-- Opt-in in 16.x; planned as the default in a future major.
+- Opt-in config in 16.x, but [`create-next-app` enables it since 16.4](https://nextjs.org/blog/next-16-4); planned as the default in Next.js 17.
 
 ### Streaming and `loading.tsx`
 
-- **`loading.tsx`** wraps the segment's page in `<Suspense>`: navigation shows the fallback at once while the shared layout stays interactive.
-- Once streaming starts, the status (**200**) and headers are already sent — a `notFound()` or `redirect()` inside streamed content can't change the status code.
+- [`loading.tsx`](https://nextjs.org/docs/app/api-reference/file-conventions/loading) wraps the segment's page in [`<Suspense>`](https://react.dev/reference/react/Suspense): navigation shows the fallback at once while the shared layout stays interactive.
+- Once [streaming](https://nextjs.org/docs/app/guides/streaming) starts, the status (200) and headers are already sent — a [`notFound()`](https://nextjs.org/docs/app/api-reference/functions/not-found) or [`redirect()`](https://nextjs.org/docs/app/api-reference/functions/redirect) inside streamed content can't change the status code.
 - Wrap each slow component in its own `<Suspense>` so it streams separately instead of blocking the whole page.
 
 ### Server-side waterfalls
 
 - Sequential `await`s in one component, or a parent awaiting before rendering a child that fetches, run independent requests one after another.
-- Start independent requests together: **`Promise.all`**, or create the promises first and await them later.
-- Suspense streams results as they arrive but doesn't parallelize fetches the code itself serializes.
+- Start independent requests together: [`Promise.all`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Promise/all), or create the promises first and await them later.
+- [Suspense](https://react.dev/reference/react/Suspense) streams results as they arrive but doesn't parallelize fetches the code itself serializes.
 
 ### Client-only code
 
-- Everything in `app/` is a Server Component until a `'use client'` boundary (see [react.md](react.md)).
-- `dynamic(() => import('./Map'), { ssr: false })` skips server rendering for browser-only libraries, but only inside a Client Component — a Server Component errors.
-- **`useSearchParams`** in a prerendered route client-renders everything up to the nearest `<Suspense>`; without one the production build fails.
+- Everything in `app/` is a Server Component until a [`'use client'`](https://nextjs.org/docs/app/api-reference/directives/use-client) boundary (see [react.md](react.md)).
+- [`dynamic(() => import('./Map'), { ssr: false })`](https://nextjs.org/docs/app/guides/lazy-loading) skips server rendering for browser-only libraries, but only inside a Client Component — a Server Component errors.
+- [`useSearchParams`](https://nextjs.org/docs/app/api-reference/functions/use-search-params) in a prerendered route client-renders everything up to the nearest `<Suspense>`; without one the production build fails.
 
 ## Caching
 
@@ -43,34 +44,34 @@ What experienced Next.js engineers forget before an interview, grouped by subtop
 
 | Layer | Where | Stores | Default since Next.js 15 |
 |---|---|---|---|
-| Request memoization | server, one render | duplicate `fetch` GETs | on |
-| Data Cache | server, persistent | `fetch` responses | **off** (on in 14) — opt in with `cache: 'force-cache'` or `next: { revalidate }` |
+| [Request memoization](https://nextjs.org/docs/app/guides/caching-without-cache-components#deduplicating-requests) | server, one render | duplicate `fetch` GETs | on |
+| [Data Cache](https://nextjs.org/docs/app/guides/caching-without-cache-components#caching-fetch-requests) | server, persistent | `fetch` responses | off (on in 14) — opt in with `cache: 'force-cache'` or `next: { revalidate }` |
 | Full Route Cache | server, persistent | HTML + RSC payload of prerendered routes | on for static routes |
-| Router Cache | browser memory | RSC payload of visited and prefetched segments | layouts and loading states reused; pages **0 s** (`staleTimes.dynamic`); any revalidation in a Server Action clears it |
+| Router Cache | browser memory | RSC payload of visited and prefetched segments | layouts and loading states reused; pages 0 s ([`staleTimes.dynamic`](https://nextjs.org/docs/app/api-reference/config/next-config-js/staleTimes)); any revalidation in a Server Action clears it |
 
 ### `'use cache'`
 
-- Caches the return value of a function, component, or whole file; the key includes the build, the function, and its serialized **arguments and closed-over values**.
-- Can't call `cookies()` or `headers()` inside — read them outside and pass the values in, or use `'use cache: private'` (per user, kept only in browser memory).
-- Default storage is in memory per server instance; **`'use cache: remote'`** stores entries in a shared cache handler across instances.
-- `cacheLife` sets `stale` (client, minimum 30 s), `revalidate` (server, stale-while-revalidate), and `expire`; the **default profile** is 5 min / 15 min / never.
-- `cacheTag('posts')` labels an entry for on-demand invalidation.
+- [`'use cache'`](https://nextjs.org/docs/app/api-reference/directives/use-cache) caches the return value of a function, component, or whole file; the key includes the build, the function, and its serialized arguments and closed-over values.
+- Can't call `cookies()` or `headers()` inside — read them outside and pass the values in, or use [`'use cache: private'`](https://nextjs.org/docs/app/api-reference/directives/use-cache-private) (per user, kept only in browser memory).
+- Default storage is in memory per server instance; [`'use cache: remote'`](https://nextjs.org/docs/app/api-reference/directives/use-cache-remote) stores entries in a shared [cache handler](https://nextjs.org/docs/app/api-reference/config/next-config-js/cacheHandlers) across instances.
+- [`cacheLife`](https://nextjs.org/docs/app/api-reference/functions/cacheLife) sets `stale` (client, minimum 30 s), `revalidate` (server, stale-while-revalidate), and `expire`; the default profile is 5 min / 15 min / never.
+- [`cacheTag('posts')`](https://nextjs.org/docs/app/api-reference/functions/cacheTag) labels an entry for on-demand invalidation.
 
 ### Invalidation APIs
 
 | API | Callable from | Effect |
 |---|---|---|
-| `revalidateTag(tag, 'max')` | Server Actions, Route Handlers | marks tagged entries stale; the next visitor gets stale content while it refreshes (SWR); the one-argument form is deprecated in 16 |
-| `updateTag(tag)` | Server Actions only | expires entries and reads fresh data in the same request (**read-your-writes**) |
-| `revalidatePath('/blog')` | Server Actions, Route Handlers | invalidates everything rendered for a path |
-| `refresh()` | Server Actions only | re-renders uncached data; the cache is untouched |
-| `router.refresh()` | Client Components | re-fetches the current route's RSC payload, keeps client state |
+| [`revalidateTag(tag, 'max')`](https://nextjs.org/docs/app/api-reference/functions/revalidateTag) | Server Actions, Route Handlers | marks tagged entries stale; the next visitor gets stale content while it refreshes (SWR); the one-argument form is deprecated in 16 |
+| [`updateTag(tag)`](https://nextjs.org/docs/app/api-reference/functions/updateTag) | Server Actions only | expires entries and reads fresh data in the same request (read-your-writes) |
+| [`revalidatePath('/blog')`](https://nextjs.org/docs/app/api-reference/functions/revalidatePath) | Server Actions, Route Handlers | invalidates everything rendered for a path |
+| [`refresh()`](https://nextjs.org/docs/app/api-reference/functions/refresh) | Server Actions only | re-renders uncached data; the cache is untouched |
+| [`router.refresh()`](https://nextjs.org/docs/app/api-reference/functions/use-router) | Client Components | re-fetches the current route's RSC payload, keeps client state |
 
 ### Request memoization
 
-- Identical `fetch` GETs in one render pass run once across layouts, pages, and `generateMetadata` — not in Route Handlers.
-- For database and SDK calls, wrap the function in React **`cache()`** so `generateMetadata` and the page share one query.
-- Memoization lasts **one request**; persistence across requests needs `'use cache'` or the Data Cache.
+- Identical `fetch` GETs in one render pass run once across layouts, pages, and [`generateMetadata`](https://nextjs.org/docs/app/api-reference/functions/generate-metadata) — not in Route Handlers.
+- For database and SDK calls, wrap the function in React [`cache()`](https://react.dev/reference/react/cache) so `generateMetadata` and the page share one query.
+- Memoization lasts one request; persistence across requests needs [`'use cache'`](https://nextjs.org/docs/app/api-reference/directives/use-cache) or the Data Cache.
 
 ## Routing
 
@@ -78,79 +79,79 @@ What experienced Next.js engineers forget before an interview, grouped by subtop
 
 | File | Role |
 |---|---|
-| `layout` | shared UI; persists across navigations without re-rendering |
-| `template` | like a layout, but remounts when its segment changes |
-| `loading` | `<Suspense>` fallback for the segment |
-| `error` | error boundary; must be a Client Component |
-| `not-found` | UI for `notFound()` |
-| `global-error` | replaces the root layout on error; renders its own `<html>` and `<body>` |
-| `route` | Route Handler; can't share a segment with `page` |
-| `default` | fallback for an unmatched parallel-route slot |
+| [`layout`](https://nextjs.org/docs/app/api-reference/file-conventions/layout) | shared UI; persists across navigations without re-rendering |
+| [`template`](https://nextjs.org/docs/app/api-reference/file-conventions/template) | like a layout, but remounts when its segment changes |
+| [`loading`](https://nextjs.org/docs/app/api-reference/file-conventions/loading) | `<Suspense>` fallback for the segment |
+| [`error`](https://nextjs.org/docs/app/api-reference/file-conventions/error) | error boundary; must be a Client Component |
+| [`not-found`](https://nextjs.org/docs/app/api-reference/file-conventions/not-found) | UI for `notFound()` |
+| [`global-error`](https://nextjs.org/docs/app/api-reference/file-conventions/error#global-error) | replaces the root layout on error; renders its own `<html>` and `<body>` |
+| [`route`](https://nextjs.org/docs/app/api-reference/file-conventions/route) | Route Handler; can't share a segment with `page` |
+| [`default`](https://nextjs.org/docs/app/api-reference/file-conventions/default) | fallback for an unmatched parallel-route slot |
 
 ### Error handling
 
-- `error.tsx` wraps the segment's page and nested segments but **not its own layout** — a layout error goes to the parent's boundary, and a root layout error to `global-error.tsx`.
-- **`retry()`** re-fetches and re-renders Server Component children; `reset()` only clears the client error state, so it can't recover from a server error.
-- `catchError(Fallback)` from `next/error` (16.3) builds component-level boundaries that let `redirect()` and `notFound()` pass through.
-- In production, Server Component errors reach the client as a generic message plus a **`digest`** that matches the server log entry.
+- [`error.tsx`](https://nextjs.org/docs/app/api-reference/file-conventions/error) wraps the segment's page and nested segments but not its own layout — a layout error goes to the parent's boundary, and a root layout error to `global-error.tsx`.
+- [`retry()`](https://nextjs.org/docs/app/api-reference/file-conventions/error#retry) (stable in 16.3) re-fetches and re-renders Server Component children; [`reset()`](https://nextjs.org/docs/app/api-reference/file-conventions/error#reset) only clears the client error state, so it can't recover from a server error.
+- [`catchError(Fallback)`](https://nextjs.org/docs/app/api-reference/functions/catchError) from `next/error` (16.3) builds component-level boundaries that let `redirect()` and `notFound()` pass through.
+- In production, Server Component errors reach the client as a generic message plus a [`digest`](https://nextjs.org/docs/app/api-reference/file-conventions/error#errordigest) that matches the server log entry.
 
 ### Layouts and templates
 
-- Layouts persist: navigating between child pages doesn't remount or re-render them, so their state survives and only changed segments are fetched (**partial rendering**).
-- A Server Component layout can't read the current pathname or `searchParams` — use `usePathname`/`useSearchParams` in a Client Component.
-- `template.tsx` remounts when its own segment, including dynamic params, changes — not on deeper navigations or search-param changes; use it for enter animations or per-page effects.
+- [Layouts](https://nextjs.org/docs/app/api-reference/file-conventions/layout) persist: navigating between child pages doesn't remount or re-render them, so their state survives and only changed segments are fetched (partial rendering).
+- A Server Component layout can't read the current pathname or `searchParams` — use [`usePathname`](https://nextjs.org/docs/app/api-reference/functions/use-pathname)/[`useSearchParams`](https://nextjs.org/docs/app/api-reference/functions/use-search-params) in a Client Component.
+- [`template.tsx`](https://nextjs.org/docs/app/api-reference/file-conventions/template) remounts when its own segment, including dynamic params, changes — not on deeper navigations or search-param changes; use it for enter animations or per-page effects.
 
 ### Dynamic segments
 
-- **`params` and `searchParams` are Promises** since Next.js 15 (`await params`); 16 removed sync access, as for `cookies()`, `headers()`, and `draftMode()`.
-- `(group)` folders organize routes without adding a URL segment and allow several root layouts; `_folder` is private and never routed.
-- `next/root-params` (16.3) reads root params like `[lang]` from any Server Component without prop drilling.
+- [`params`](https://nextjs.org/docs/app/api-reference/file-conventions/dynamic-routes) and `searchParams` are Promises since Next.js 15 (`await params`); [16 removed sync access](https://nextjs.org/docs/app/guides/upgrading/version-16), as for `cookies()`, `headers()`, and [`draftMode()`](https://nextjs.org/docs/app/api-reference/functions/draft-mode).
+- [`(group)`](https://nextjs.org/docs/app/api-reference/file-conventions/route-groups) folders organize routes without adding a URL segment and allow several root layouts; [`_folder`](https://nextjs.org/docs/app/getting-started/project-structure#private-folders) is private and never routed.
+- [`next/root-params`](https://nextjs.org/docs/app/api-reference/functions/next-root-params) (16.3) reads root params like `[lang]` from any Server Component without prop drilling.
 
 ### Parallel and intercepting routes
 
-- **`@slot`** folders render several pages in one layout at once (dashboard panels, modals); slots aren't URL segments.
-- On a hard load, a slot with no match renders `default.tsx` — required for every slot since **Next.js 16**, or the build fails.
-- **Intercepting routes** like `(.)photo/[id]` show a route inside the current layout on client navigation; a refresh or shared link renders the full page — the photo-modal pattern.
+- [`@slot`](https://nextjs.org/docs/app/api-reference/file-conventions/parallel-routes) folders render several pages in one layout at once (dashboard panels, modals); slots aren't URL segments.
+- On a hard load, a slot with no match renders [`default.tsx`](https://nextjs.org/docs/app/api-reference/file-conventions/default) — required for every slot since Next.js 16, or the build fails.
+- [Intercepting routes](https://nextjs.org/docs/app/api-reference/file-conventions/intercepting-routes) like `(.)photo/[id]` show a route inside the current layout on client navigation; a refresh or shared link renders the full page — the photo-modal pattern.
 - `(..)` and `(...)` match one segment up and the app root — counted in route segments, not folders.
 
 ### Metadata
 
-- A layout or page exports a static `metadata` object or an async **`generateMetadata`** — Server Components only.
-- Metadata from nested segments merges **shallowly**: a child's `openGraph` replaces the parent's whole `openGraph`, so spread shared fields in.
+- A layout or page exports a static `metadata` object or an async [`generateMetadata`](https://nextjs.org/docs/app/api-reference/functions/generate-metadata) — Server Components only.
+- Metadata from nested segments [merges shallowly](https://nextjs.org/docs/app/api-reference/functions/generate-metadata#merging): a child's `openGraph` replaces the parent's whole `openGraph`, so spread shared fields in.
 - `generateMetadata` can call `redirect()` and `notFound()`, and its `fetch` calls are memoized with the page's.
 
 ### Navigation and prefetching
 
-- Without Partial Prefetching, `<Link>` prefetches when it enters the viewport, **in production only**: static routes fully, dynamic routes down to the nearest `loading.tsx`; `prefetch={true}` fetches the full route.
-- Next.js 16 downloads a shared layout once across many links and only prefetches segments not already cached.
-- **Partial Prefetching** (16.3, `partialPrefetching: true`) prefetches one reusable shell per route instead of a request per link; `prefetch={true}` adds the link's cached, URL-dependent content.
-- In the App Router, `useRouter` comes from `next/navigation`; `next/router` belongs to the Pages Router.
+- Without Partial Prefetching, [`<Link>`](https://nextjs.org/docs/app/api-reference/components/link#prefetch) prefetches when it enters the viewport, in production only: static routes fully, dynamic routes down to the nearest `loading.tsx`; `prefetch={true}` fetches the full route.
+- Next.js 16 downloads a shared layout once across many links and only [prefetches](https://nextjs.org/docs/app/guides/prefetching) segments not already cached.
+- [Partial Prefetching](https://nextjs.org/docs/app/api-reference/config/next-config-js/partialPrefetching) (16.3, `partialPrefetching: true`) prefetches one reusable shell per route instead of a request per link; `prefetch={true}` adds the link's cached, URL-dependent content.
+- In the App Router, [`useRouter`](https://nextjs.org/docs/app/api-reference/functions/use-router) comes from `next/navigation`; `next/router` belongs to the Pages Router.
 
 ## Server Actions
 
 ### Server Actions in Next.js
 
-- A `'use server'` function passed to `<form action>` works **without JavaScript** (progressive enhancement); event handlers can call it too.
-- Always a **POST**; Next.js rejects requests whose `Origin` host doesn't match `x-forwarded-host` or `host` (CSRF check); `serverActions.allowedOrigins` adds extra hosts.
-- The request body limit is **1 MB** by default (`serverActions.bodySizeLimit`).
-- After the mutation, call `updateTag` or `revalidatePath`, then `redirect`; the response carries the updated RSC payload in the same round trip.
-- `after(fn)` (stable since 15.1) runs logging or analytics after the response is sent — in Server Actions, Route Handlers, and Server Components.
+- A [`'use server'`](https://nextjs.org/docs/app/api-reference/directives/use-server) function passed to `<form action>` works without JavaScript ([progressive enhancement](https://developer.mozilla.org/en-US/docs/Glossary/Progressive_Enhancement)); event handlers can call it too.
+- Always a POST; Next.js rejects requests whose `Origin` host doesn't match `x-forwarded-host` or `host` (CSRF check, see [security.md](security.md)); [`serverActions.allowedOrigins`](https://nextjs.org/docs/app/api-reference/config/next-config-js/serverActions#allowedorigins) adds extra hosts.
+- The request body limit is 1 MB by default ([`serverActions.bodySizeLimit`](https://nextjs.org/docs/app/api-reference/config/next-config-js/serverActions#bodysizelimit)).
+- After the mutation, call [`updateTag`](https://nextjs.org/docs/app/api-reference/functions/updateTag) or [`revalidatePath`](https://nextjs.org/docs/app/api-reference/functions/revalidatePath), then `redirect`; the response carries the updated RSC payload in the same round trip.
+- [`after(fn)`](https://nextjs.org/docs/app/api-reference/functions/after) (stable since 15.1) runs logging or analytics after the response is sent — in Server Actions, Route Handlers, and Server Components.
 
 ### Closures and action IDs
 
-- An inline Server Action can capture variables from the component that renders it; Next.js **encrypts** them before sending them to the client — still, never capture secrets.
+- An inline Server Action can capture variables from the component that renders it; Next.js [encrypts](https://nextjs.org/docs/app/guides/data-security#closures-and-encryption) them before sending them to the client — still, never capture secrets.
 - Action IDs are encrypted, non-deterministic, and regenerated per build; unused actions are dropped from the client bundle.
-- Several self-hosted instances need the same **`NEXT_SERVER_ACTIONS_ENCRYPTION_KEY`** at build, or one instance can't decrypt another's closures ("Failed to find Server Action").
+- Several self-hosted instances need the same [`NEXT_SERVER_ACTIONS_ENCRYPTION_KEY`](https://nextjs.org/docs/app/guides/data-security#overwriting-encryption-keys-advanced) at build, or one instance can't decrypt another's closures ("Failed to find Server Action").
 
 ### `redirect` and `notFound`
 
-- **`redirect()`** and `notFound()` work by throwing — call them outside `try`, or call `unstable_rethrow(err)` first in the `catch`.
-- `redirect` responds 307 by default; in a Server Action it becomes a client navigation (303 without JavaScript); `permanentRedirect` uses 308.
-- In client event handlers use `router.push` — `redirect` only works during render and in server code.
+- [`redirect()`](https://nextjs.org/docs/app/api-reference/functions/redirect) and [`notFound()`](https://nextjs.org/docs/app/api-reference/functions/not-found) work by throwing — call them outside `try`, or call [`unstable_rethrow(err)`](https://nextjs.org/docs/app/api-reference/functions/unstable_rethrow) first in the `catch`.
+- `redirect` responds 307 by default; in a Server Action it becomes a client navigation (303 without JavaScript); [`permanentRedirect`](https://nextjs.org/docs/app/api-reference/functions/permanentRedirect) uses 308.
+- In client event handlers use [`router.push`](https://nextjs.org/docs/app/api-reference/functions/use-router) — `redirect` only works during render and in server code.
 
 ### Route Handlers vs Server Actions
 
-| | Route Handler (`route.ts`) | Server Action |
+| | [Route Handler](https://nextjs.org/docs/app/api-reference/file-conventions/route) (`route.ts`) | [Server Action](https://nextjs.org/docs/app/guides/server-actions) |
 |---|---|---|
 | Caller | any HTTP client | your own React UI |
 | Methods | GET, POST, PUT, DELETE, … | POST only |
@@ -162,71 +163,71 @@ What experienced Next.js engineers forget before an interview, grouped by subtop
 
 ### `proxy.ts`
 
-- **`proxy.ts`** (renamed from `middleware.ts` in Next.js 16) runs before routing and caches on every matched request: redirects, rewrites, headers, A/B tests, i18n.
-- It runs on the **Node.js runtime** only; `middleware.ts` still works for the Edge runtime but is deprecated.
-- Narrow it with `config.matcher`, excluding `_next/static`, `_next/image`, and assets; there's one proxy file per project.
+- [`proxy.ts`](https://nextjs.org/docs/app/api-reference/file-conventions/proxy) (renamed from `middleware.ts` in Next.js 16) runs before routing and caches on every matched request: redirects, rewrites, headers, A/B tests, i18n.
+- It runs on the Node.js runtime only; `middleware.ts` still works for the [Edge runtime](https://nextjs.org/docs/app/api-reference/edge) but is deprecated.
+- Narrow it with [`config.matcher`](https://nextjs.org/docs/app/api-reference/file-conventions/proxy#matcher), excluding `_next/static`, `_next/image`, and assets; there's one proxy file per project.
 
 ### Authorization placement
 
-- Proxy is for **optimistic checks** only (decode the session cookie, redirect) — it also runs on prefetches, so no database calls.
-- Real authorization belongs in a **Data Access Layer** that verifies the session next to every query, Server Action, and Route Handler.
-- **CVE-2025-29927** (March 2025, CVSS 9.1): a spoofed `x-middleware-subrequest` header skipped middleware entirely; fixed in 15.2.3 and 14.2.25 — apps that checked auth only in middleware were open.
+- [Proxy](https://nextjs.org/docs/app/api-reference/file-conventions/proxy) is for optimistic checks only (decode the session cookie, redirect) — it also runs on prefetches, so no database calls.
+- Real authorization belongs in a [Data Access Layer](https://nextjs.org/docs/app/guides/data-security#data-access-layer) that verifies the session next to every query, Server Action, and Route Handler.
+- [CVE-2025-29927](https://nvd.nist.gov/vuln/detail/CVE-2025-29927) (March 2025, CVSS 9.1): a spoofed `x-middleware-subrequest` header skipped middleware entirely; fixed in 15.2.3 and 14.2.25 — apps that checked auth only in middleware were open.
 
 ### Server-only code
 
-- `import 'server-only'` fails the build if a module with secrets or database access ends up in client code.
-- Props passed to Client Components are serialized into the page — return DTOs from the data layer, not raw rows.
+- [`import 'server-only'`](https://nextjs.org/docs/app/getting-started/server-and-client-components#preventing-environment-poisoning) fails the build if a module with secrets or database access ends up in client code.
+- Props passed to Client Components are serialized into the page — return [DTOs](https://nextjs.org/docs/app/guides/data-security#data-access-layer) from the data layer, not raw rows.
 
 ## Build and deployment
 
 ### Environment variables
 
-- **`NEXT_PUBLIC_*`** values are inlined into client JS at **build time** — changing them at runtime does nothing, so one Docker image can't serve several environments that way.
+- [`NEXT_PUBLIC_*`](https://nextjs.org/docs/app/guides/environment-variables#bundling-environment-variables-for-the-browser) values are inlined into client JS at build time — changing them at runtime does nothing, so one Docker image can't serve several environments that way.
 - Other variables are server-only and read when the code runs: at build for prerendered routes, per request for dynamic ones.
-- Next.js 16 removed `serverRuntimeConfig` and `publicRuntimeConfig` — use environment variables.
+- [Next.js 16 removed](https://nextjs.org/docs/app/guides/upgrading/version-16) `serverRuntimeConfig` and `publicRuntimeConfig` — use environment variables.
 
 ### Output modes and self-hosting
 
-- **`output: 'standalone'`** traces only the files and `node_modules` the server needs into `.next/standalone`; copy `public/` and `.next/static` yourself or serve them from a CDN.
-- **`output: 'export'`** emits static files only: no proxy, Server Actions, ISR, rewrites, cookies, or default image optimization.
-- ISR and `'use cache'` entries live per instance by default — several instances need a shared cache handler.
+- [`output: 'standalone'`](https://nextjs.org/docs/app/api-reference/config/next-config-js/output#automatically-copying-traced-files) traces only the files and `node_modules` the server needs into `.next/standalone`; copy `public/` and `.next/static` yourself or serve them from a CDN.
+- [`output: 'export'`](https://nextjs.org/docs/app/guides/static-exports#unsupported-features) emits static files only: no proxy, Server Actions, ISR, rewrites, cookies, or default image optimization.
+- ISR and `'use cache'` entries live per instance by default — several instances need a shared [cache handler](https://nextjs.org/docs/app/guides/self-hosting#caching-and-isr).
 
 ### Version skew
 
 - During a rolling deploy, old clients can request deleted chunks, call Server Action IDs the new build doesn't know, or fetch incompatible RSC payloads.
-- **`deploymentId`** tags assets (`?dpl=`) and navigations (`x-deployment-id`); a mismatch triggers a full reload instead of a client navigation.
-- Vercel's Skew Protection keeps old deployments reachable for a while; self-hosted setups keep old static assets around after a deploy.
+- [`deploymentId`](https://nextjs.org/docs/app/api-reference/config/next-config-js/deploymentId) tags assets (`?dpl=`) and navigations (`x-deployment-id`); a mismatch triggers a full reload instead of a client navigation.
+- Vercel's [Skew Protection](https://vercel.com/docs/skew-protection) keeps old deployments reachable for a while; self-hosted setups keep old static assets around after a deploy.
 
 ### Turbopack and runtimes
 
-- **Turbopack** is the default bundler for `next dev` and `next build` since **Next.js 16**; `--webpack` opts out.
-- Its file-system cache is on by default for dev since 16.1 and for builds since 16.3.
-- `next build` no longer lints — Next.js 16 removed `next lint`.
-- The Edge runtime (`export const runtime = 'edge'`) runs on V8 isolates with Web APIs only — no `fs` or native modules; Node.js is the default and supports every feature.
+- [Turbopack](https://nextjs.org/docs/app/api-reference/turbopack) is the default bundler for `next dev` and `next build` since Next.js 16; `--webpack` opts out.
+- Its [file-system cache](https://nextjs.org/docs/app/api-reference/config/next-config-js/turbopackFileSystemCache) is on by default for dev since 16.1 and for builds since 16.3.
+- `next build` no longer lints — [Next.js 16 removed `next lint`](https://nextjs.org/docs/app/guides/upgrading/version-16).
+- The [Edge runtime](https://nextjs.org/docs/app/api-reference/edge) (`export const runtime = 'edge'`) runs on V8 isolates with Web APIs only — no `fs` or native modules; Node.js is the default and supports every feature.
 
 ## Built-in components
 
 ### `next/image`
 
-- Resizes and converts to WebP/AVIF on demand, lazy-loads by default, and needs `width`/`height` or **`fill`** to reserve space against layout shift.
-- A `fill` image without `sizes` is assumed to be `100vw` wide and downloads a larger file than needed.
-- Mark the LCP image with **`preload`**, which replaced `priority` (deprecated in Next.js 16).
-- Remote hosts must match `images.remotePatterns`; `images.domains` is deprecated.
-- Next.js 16 defaults: a 4-hour `minimumCacheTTL`, `qualities: [75]`, and local IPs blocked.
+- [`next/image`](https://nextjs.org/docs/app/api-reference/components/image) resizes and converts to WebP/AVIF on demand, lazy-loads by default, and needs `width`/`height` or [`fill`](https://nextjs.org/docs/app/api-reference/components/image#fill) to reserve space against layout shift.
+- A `fill` image without [`sizes`](https://nextjs.org/docs/app/api-reference/components/image#sizes) is assumed to be `100vw` wide and downloads a larger file than needed.
+- Mark the LCP image with `loading="eager"` or `fetchPriority="high"`; [`preload`](https://nextjs.org/docs/app/api-reference/components/image#preload) adds a `<link>` in `<head>` for early discovery; `priority` is deprecated since Next.js 16.
+- Remote hosts must match [`images.remotePatterns`](https://nextjs.org/docs/app/api-reference/components/image#remotepatterns); `images.domains` is deprecated.
+- Next.js 16 defaults: a 4-hour [`minimumCacheTTL`](https://nextjs.org/docs/app/api-reference/components/image#minimumcachettl), `qualities: [75]`, and local IPs blocked.
 
 ### `next/font`
 
-- Downloads Google Fonts at **build time** and serves them from your own domain — no runtime request to Google.
-- Generates a fallback font with `size-adjust` metrics, so the swap to the web font barely shifts layout.
+- [`next/font`](https://nextjs.org/docs/app/api-reference/components/font) downloads Google Fonts at build time and serves them from your own domain — no runtime request to Google.
+- Generates a fallback font with [`size-adjust`](https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@font-face/size-adjust) metrics, so the swap to the web font barely shifts layout.
 
 ### `next/script`
 
 | Strategy | Loads |
 |---|---|
-| `beforeInteractive` | before hydration, injected into the server HTML; root layout only |
-| `afterInteractive` (default) | after some of the page hydrates |
-| `lazyOnload` | during browser idle time |
-| `worker` (experimental) | in a web worker through Partytown; Pages Router only |
+| [`beforeInteractive`](https://nextjs.org/docs/app/api-reference/components/script#beforeinteractive) | before hydration, injected into the server HTML; root layout only |
+| [`afterInteractive`](https://nextjs.org/docs/app/api-reference/components/script#afterinteractive) (default) | after some of the page hydrates |
+| [`lazyOnload`](https://nextjs.org/docs/app/api-reference/components/script#lazyonload) | during browser idle time |
+| [`worker`](https://nextjs.org/docs/app/api-reference/components/script#worker) (experimental) | in a web worker through [Partytown](https://partytown.qwik.dev/); Pages Router only |
 
 ## Pages Router
 
@@ -234,15 +235,15 @@ What experienced Next.js engineers forget before an interview, grouped by subtop
 
 | Pages Router | Runs | App Router equivalent |
 |---|---|---|
-| `getStaticProps` | at build; again after `revalidate` seconds (ISR) | a prerendered Server Component, or `'use cache'` |
-| `getServerSideProps` | on every request | a Server Component reading request data |
-| `getStaticPaths` | at build | `generateStaticParams` |
-| `pages/api/*` | per request | Route Handlers |
+| [`getStaticProps`](https://nextjs.org/docs/pages/api-reference/functions/get-static-props) | at build; again after `revalidate` seconds ([ISR](https://nextjs.org/docs/pages/guides/incremental-static-regeneration)) | a prerendered Server Component, or `'use cache'` |
+| [`getServerSideProps`](https://nextjs.org/docs/pages/api-reference/functions/get-server-side-props) | on every request | a Server Component reading request data |
+| [`getStaticPaths`](https://nextjs.org/docs/pages/api-reference/functions/get-static-paths) | at build | `generateStaticParams` |
+| [`pages/api/*`](https://nextjs.org/docs/pages/building-your-application/routing/api-routes) | per request | Route Handlers |
 
 ### Pages Router differences
 
 - Every page ships its JS and hydrates in full — no Server Components.
-- `_app` wraps every page (global layout and state); `_document` customizes the HTML shell and renders only on the server.
-- Nested layouts need the per-page `getLayout` pattern; the router is `next/router`.
-- `getStaticPaths` `fallback`: `false` → 404 for unknown paths; `true` → a fallback page first (`router.isFallback`); `'blocking'` → server-render the first request, then cache it.
+- [`_app`](https://nextjs.org/docs/pages/building-your-application/routing/custom-app) wraps every page (global layout and state); [`_document`](https://nextjs.org/docs/pages/building-your-application/routing/custom-document) customizes the HTML shell and renders only on the server.
+- Nested layouts need the [per-page `getLayout` pattern](https://nextjs.org/docs/pages/building-your-application/routing/pages-and-layouts#per-page-layouts); the router is [`next/router`](https://nextjs.org/docs/pages/api-reference/functions/use-router).
+- [`getStaticPaths` `fallback`](https://nextjs.org/docs/pages/api-reference/functions/get-static-paths#fallback-false): `false` → 404 for unknown paths; `true` → a fallback page first (`router.isFallback`); `'blocking'` → server-render the first request, then cache it.
 - Both routers can coexist during a migration, but the same route in `app/` and `pages/` fails the build.
diff --git a/docs/topics/react.md b/docs/topics/react.md
index cd59e60..b877370 100644
--- a/docs/topics/react.md
+++ b/docs/topics/react.md
@@ -6,266 +6,266 @@ What experienced React engineers forget before an interview, grouped by subtopic
 
 ### Render and commit
 
-- **Render phase**: React calls components to compute the next tree; **commit phase**: it applies DOM changes, runs layout effects, then passive effects (usually after paint).
-- Render must be **pure** — it may run more than once for one commit (Strict Mode, interrupted concurrent renders).
-- A component re-renders on its own state change, a parent re-render (unless memoized), or a consumed context value change — never because a prop changed on its own.
+- [Render phase](https://react.dev/learn/render-and-commit): React calls components to compute the next tree; commit phase: it applies DOM changes, runs layout effects, then passive effects (usually after paint).
+- Render must be [pure](https://react.dev/learn/keeping-components-pure) — it may run more than once for one commit ([Strict Mode](https://react.dev/reference/react/StrictMode), interrupted concurrent renders).
+- A component re-renders on its own state change, a parent re-render (unless [memoized](https://react.dev/reference/react/memo)), or a consumed context value change — never because a prop changed on its own.
 
 ### Reconciliation and keys
 
-- A different element **type** at the same position unmounts the old subtree and its state; the same type updates in place.
-- **Keys** match list items across renders; an array index as key attaches the wrong state after reorder or filter.
+- A different element type at the same position [unmounts the old subtree and its state](https://react.dev/learn/preserving-and-resetting-state#different-components-at-the-same-position-reset-state); the same type updates in place.
+- [Keys](https://react.dev/learn/rendering-lists#keeping-list-items-in-order-with-key) match list items across renders; an array index as key attaches the wrong state after reorder or filter.
 - A component defined inside another component is a new type on every render, so its subtree remounts and loses state each time.
 
 ### State and tree position
 
-- State belongs to a **position** in the tree, not to a variable: `{isAdmin ? <Form /> : <Form />}` keeps one shared state.
-- Changing a component's **`key`** remounts it and resets its state — the clean way to reset a form when the selected item changes.
+- State belongs to a [position in the tree](https://react.dev/learn/preserving-and-resetting-state), not to a variable: `{isAdmin ? <Form /> : <Form />}` keeps one shared state.
+- Changing a component's [`key`](https://react.dev/learn/preserving-and-resetting-state#option-2-resetting-state-with-a-key) remounts it and resets its state — the clean way to reset a form when the selected item changes.
 
 ### State snapshots and batching
 
-- State is a **snapshot** per render: `setCount(count + 1)` twice adds 1; the updater form `setCount(c => c + 1)` twice adds 2.
-- **Automatic batching** (React 18+) merges all updates from one tick into one render, including in timeouts and promises.
-- `flushSync(() => setValue(x))` opts out: it renders and commits synchronously before returning.
-- Setting state to an `Object.is`-equal value skips the re-render — mutating an object in place and setting it again does nothing.
-- `useRef` holds a mutable value across renders without triggering a re-render; don't read or write it during render.
+- State is a [snapshot](https://react.dev/learn/state-as-a-snapshot) per render: `setCount(count + 1)` twice adds 1; the [updater form](https://react.dev/learn/queueing-a-series-of-state-updates) `setCount(c => c + 1)` twice adds 2.
+- [Automatic batching](https://react.dev/blog/2022/03/29/react-v18#new-feature-automatic-batching) (React 18+) merges updates queued in the same event or task into one render, including in timeouts and promises; separate events still render separately.
+- [`flushSync(() => setValue(x))`](https://react.dev/reference/react-dom/flushSync) opts out: it renders and commits synchronously before returning.
+- Setting state to an [`Object.is`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/is)-equal value skips the re-render — mutating an object in place and setting it again does nothing.
+- [`useRef`](https://react.dev/reference/react/useRef) holds a mutable value across renders without triggering a re-render; don't read or write it during render.
 
 ### Fiber and concurrent rendering
 
-- **Fiber** splits rendering into interruptible units: the render phase can pause, restart, or be discarded; the commit phase is synchronous.
-- Time slicing applies only to updates marked non-urgent (transitions, deferred values); other updates render without yielding.
-- **Tearing**: an interrupted render can read different values from a mutable external store in different components — `useSyncExternalStore` prevents it.
+- [Fiber](https://github.com/acdlite/react-fiber-architecture) splits rendering into interruptible units: the render phase can pause, restart, or be discarded; the commit phase is synchronous.
+- Time slicing applies only to updates marked non-urgent ([transitions](https://react.dev/reference/react/useTransition), deferred values); other updates render without yielding.
+- [Tearing](https://github.com/reactwg/react-18/discussions/69): an interrupted render can read different values from a mutable external store in different components — [`useSyncExternalStore`](https://react.dev/reference/react/useSyncExternalStore) prevents it.
 
 ## Hooks
 
 ### Rules of Hooks
 
-- React identifies each hook's state by **call order**, so hooks run at the top level in the same order every render — no conditions, loops, or calls after an early return.
-- **`use`** is the exception: it may be called inside `if` and loops, but not inside `try/catch`.
-- Custom hooks share logic, not state: each call gets its own state.
+- React identifies each hook's state by call order, so hooks run at the top level in the same order every render — no conditions, loops, or calls after an early return ([Rules of Hooks](https://react.dev/reference/rules/rules-of-hooks)).
+- [`use`](https://react.dev/reference/react/use) is the exception: it may be called inside `if` and loops, but not inside `try/catch`.
+- [Custom hooks](https://react.dev/learn/reusing-logic-with-custom-hooks) share logic, not state: each call gets its own state.
 
 ### Effect timing
 
 | Hook | Runs | Use for |
 |---|---|---|
-| `useEffect` | after commit, usually after paint | subscriptions, syncing with external systems |
-| `useLayoutEffect` | after DOM mutation, **before paint** (blocks it) | measuring layout and re-rendering without flicker (tooltips) |
-| `useInsertionEffect` | before layout effects | CSS-in-JS style injection |
+| [`useEffect`](https://react.dev/reference/react/useEffect) | after commit, usually after paint | subscriptions, syncing with external systems |
+| [`useLayoutEffect`](https://react.dev/reference/react/useLayoutEffect) | after DOM mutation, before paint (blocks it) | measuring layout and re-rendering without flicker (tooltips) |
+| [`useInsertionEffect`](https://react.dev/reference/react/useInsertionEffect) | before layout effects | CSS-in-JS style injection |
 
 ### Stale closures
 
-- An effect or callback sees the values from the render that created it; a value missing from the dependency array stays **stale**.
-- Fix by restructuring (a ref, a functional `setState`, moving the logic into the effect, an Effect Event) — not by silencing the lint rule.
+- An effect or callback sees the values from the render that created it; a value missing from the [dependency array](https://react.dev/learn/lifecycle-of-reactive-effects#react-verifies-that-you-specified-every-reactive-value-as-a-dependency) stays stale.
+- Fix by restructuring (a ref, a functional `setState`, moving the logic into the effect, an [Effect Event](https://react.dev/reference/react/useEffectEvent)) — not by silencing the [lint rule](https://react.dev/reference/eslint-plugin-react-hooks/lints/exhaustive-deps).
 
 ### Effect Events
 
-- **`useEffectEvent`** (stable in 19.2) wraps logic that must read the latest props or state without re-running the effect: `onConnected` sees the current `theme` while the effect depends only on `roomId`.
+- [`useEffectEvent`](https://react.dev/reference/react/useEffectEvent) ([stable in 19.2](https://react.dev/blog/2025/10/01/react-19-2#use-effect-event)) wraps logic that must read the latest props or state without re-running the effect: `onConnected` sees the current `theme` while the effect depends only on `roomId`.
 - Effect Events stay out of dependency arrays and may only be called from effects in the same component.
 - Only for code that is conceptually an event fired by the effect — not a way to silence the lint rule.
 
 ### Unnecessary effects
 
-- Deriving state inside an effect + `setState` causes an extra render and a flash — **compute it during render**.
-- Logic caused by a user action belongs in the event handler, not in an effect watching a flag.
-- Every subscription, timer, or listener an effect creates needs a **cleanup** function.
+- Deriving state inside an effect + `setState` causes an extra render and a flash — [compute it during render](https://react.dev/learn/you-might-not-need-an-effect#updating-state-based-on-props-or-state).
+- Logic caused by a user action belongs in the event handler, not in an effect watching a flag ([You Might Not Need an Effect](https://react.dev/learn/you-might-not-need-an-effect)).
+- Every subscription, timer, or listener an effect creates needs a [cleanup](https://react.dev/learn/synchronizing-with-effects#step-3-add-cleanup-if-needed) function.
 
 ### Data fetching in effects
 
-- Responses can arrive **out of order**: ignore stale ones in the effect cleanup (an `ignore` flag or `AbortController`), or a slow earlier request overwrites newer data.
-- Effect-based fetching creates **waterfalls** (parent fetches → child mounts → child fetches); hoist fetching to route loaders, Server Components, or a query library.
-- Strict Mode runs setup → cleanup → setup in development, so the request fires twice; the cleanup is what makes the first response get ignored.
+- Responses can arrive out of order: ignore stale ones in the effect cleanup (an `ignore` flag or [`AbortController`](https://developer.mozilla.org/en-US/docs/Web/API/AbortController)), or a slow earlier request overwrites newer data ([race conditions](https://react.dev/learn/you-might-not-need-an-effect#fetching-data)).
+- Effect-based fetching creates waterfalls (parent fetches → child mounts → child fetches); hoist fetching to route loaders, Server Components, or a query library.
+- [Strict Mode](https://react.dev/reference/react/StrictMode) at the root runs setup → cleanup → setup in development, so the request fires twice; the cleanup is what makes the first response get ignored.
 
 ### `useSyncExternalStore`
 
-- Subscribes components to an external store (a browser API, Redux, Zustand) with no **tearing** under concurrent rendering.
-- `getSnapshot` must return the **same value** while the store is unchanged — returning a new object on each call re-renders forever.
+- [`useSyncExternalStore`](https://react.dev/reference/react/useSyncExternalStore) subscribes components to an external store (a browser API, Redux, Zustand) with no tearing under concurrent rendering.
+- `getSnapshot` must return the same value while the store is unchanged — returning a new object on each call [re-renders forever](https://react.dev/reference/react/useSyncExternalStore#im-getting-an-error-the-result-of-getsnapshot-should-be-cached).
 - `getServerSnapshot` supplies the value for server rendering and hydration.
 
 ## State management
 
 ### Context performance
 
-- Every consumer re-renders when the provider's `value` changes **identity** — an inline object literal changes it on every render.
-- Memoize the value, split fast- and slow-changing state into separate contexts, or use a store with selectors (`useSyncExternalStore`, Zustand) so components subscribe to slices.
+- Every consumer re-renders when the provider's `value` changes identity — an inline object literal changes it on every render ([optimizing context](https://react.dev/reference/react/useContext#optimizing-re-renders-when-passing-objects-and-functions)).
+- Memoize the value, split fast- and slow-changing state into separate contexts, or use a store with selectors ([`useSyncExternalStore`](https://react.dev/reference/react/useSyncExternalStore), [Zustand](https://zustand.docs.pmnd.rs/)) so components subscribe to slices.
 - Context suits low-frequency values (theme, locale, current user), not fast-changing shared state.
 
 ### Server state vs client state
 
-- **Server state** (fetched data) has its own caching, staleness, refetching, and loading lifecycle — use TanStack Query or SWR, not a global client store.
-- These libraries dedupe requests, cache by **query key**, and refetch after invalidating a key on mutation.
+- Server state (fetched data) has its own caching, staleness, refetching, and loading lifecycle — use [TanStack Query](https://tanstack.com/query/latest) or [SWR](https://swr.vercel.app/docs/getting-started), not a global client store.
+- These libraries dedupe requests, cache by [query key](https://tanstack.com/query/latest/docs/framework/react/guides/query-keys), and refetch after [invalidating a key](https://tanstack.com/query/latest/docs/framework/react/guides/invalidations-from-mutations) on mutation.
 
 ### State placement and stores
 
-- Shareable UI state (filters, tabs, pagination) belongs in the **URL** — it survives reloads and works with the back button and shared links.
-- `useReducer` fits updates that touch several fields or follow named events; `dispatch` has a stable identity, so a context holding only `dispatch` never re-renders its consumers.
-- **Selectors** limit re-renders: Redux `useSelector` and Zustand re-render a component only when its selected value changes by reference.
-- A selector that builds a new object or array on each call defeats that — use `shallowEqual`/`useShallow` or a memoized selector.
-- Jotai splits state into atoms; a component re-renders only for the atoms it reads.
+- Shareable UI state (filters, tabs, pagination) belongs in the URL — it survives reloads and works with the back button and shared links.
+- [`useReducer`](https://react.dev/reference/react/useReducer) fits updates that touch several fields or follow named events; `dispatch` has a stable identity, so a context holding only `dispatch` never re-renders its consumers.
+- Selectors limit re-renders: Redux [`useSelector`](https://redux.js.org/react-redux/api/hooks#useselector) and Zustand re-render a component only when its selected value changes by reference.
+- A selector that builds a new object or array on each call defeats that — use `shallowEqual`/[`useShallow`](https://zustand.docs.pmnd.rs/reference/hooks/use-shallow) or a [memoized selector](https://redux.js.org/usage/deriving-data-selectors).
+- [Jotai](https://jotai.org/) splits state into atoms; a component re-renders only for the atoms it reads.
 
 ## Performance
 
 ### Memoization pitfalls
 
-- `React.memo` is defeated by a **new object, array, or function** literal passed as a prop on every render.
-- `memo` compares each prop with `Object.is`; a custom `arePropsEqual` that ignores function props leaves the child calling **stale closures**.
-- `useCallback` only helps when the function goes to a memoized child or into a dependency array.
+- [`React.memo`](https://react.dev/reference/react/memo) is defeated by a new object, array, or function literal passed as a prop on every render.
+- `memo` compares each prop with `Object.is`; a custom [`arePropsEqual`](https://react.dev/reference/react/memo#specifying-a-custom-comparison-function) that ignores function props leaves the child calling stale closures.
+- [`useCallback`](https://react.dev/reference/react/useCallback) only helps when the function goes to a memoized child or into a dependency array.
 - Memoize only when the skipped work costs more than the comparison.
 
 ### React Compiler
 
-- **React Compiler** (stable 1.0, **October 2025**) auto-memoizes components and values at build time, replacing most manual `useMemo`/`useCallback`/`memo`.
-- It relies on the Rules of React (pure render, no mutating props or state) and skips code it can't prove safe.
+- [React Compiler](https://react.dev/learn/react-compiler) ([stable 1.0, October 2025](https://react.dev/blog/2025/10/07/react-compiler-1)) auto-memoizes components and values at build time, replacing most manual `useMemo`/`useCallback`/`memo`.
+- It relies on the [Rules of React](https://react.dev/reference/rules) (pure render, no mutating props or state) and skips code it can't prove safe.
 
 ### Profiling
 
-- The React DevTools **Profiler** records which components rendered, how long they took, and why.
-- **Performance Tracks** (19.2) add React's scheduler and component work to the Chrome DevTools Performance panel.
+- The [React DevTools](https://react.dev/learn/react-developer-tools) [Profiler](https://legacy.reactjs.org/blog/2018/09/10/introducing-the-react-profiler.html) records which components rendered, how long they took, and why.
+- [Performance Tracks](https://react.dev/reference/dev-tools/react-performance-tracks) (19.2) add React's scheduler and component work to the Chrome DevTools Performance panel.
 
 ### Virtualization and code splitting
 
-- Long lists: **virtualize** (TanStack Virtual, react-window) so only the visible rows mount.
-- `lazy(() => import('./Chart'))` inside `<Suspense>` splits a component into its own chunk, loaded on first render.
+- Long lists: virtualize ([TanStack Virtual](https://tanstack.com/virtual/latest), [react-window](https://github.com/bvaughn/react-window)) so only the visible rows mount.
+- [`lazy(() => import('./Chart'))`](https://react.dev/reference/react/lazy) inside `<Suspense>` splits a component into its own chunk, loaded on first render.
 
 ## Server Components
 
 ### Server and Client Components
 
-- Server Components are the default in an RSC framework — there's **no directive** for them; `'use server'` marks Server Functions.
-- **`'use client'`** marks a module boundary: the module and everything it imports become client code.
+- [Server Components](https://react.dev/reference/rsc/server-components) are the default in an RSC framework — there's no directive for them; `'use server'` marks Server Functions.
+- [`'use client'`](https://react.dev/reference/rsc/use-client) marks a module boundary: the module and everything it imports become client code.
 - Client Components still pre-render to HTML on the server; "client" means their code also ships and hydrates.
 - Server Components can be `async` but have no state, effects, or browser APIs, and their code never reaches the client.
-- A Client Component can't import a Server Component, but it can render one passed as **`children`** or another prop.
+- A Client Component can't import a Server Component, but it can render one passed as `children` or another prop.
 
 ### Serialization boundary
 
-- Props crossing from server to client must be **serializable**: primitives, plain objects and arrays, `Date`, `Map`, `Set`, `BigInt`, typed arrays, Promises, JSX, and Server Functions.
+- Props crossing from server to client must be [serializable](https://react.dev/reference/rsc/use-client#serializable-types): primitives, plain objects and arrays, `Date`, `Map`, `Set`, `BigInt`, typed arrays, Promises, JSX, and Server Functions.
 - Plain functions and class instances can't cross — pass data, and keep event handlers inside the Client Component.
-- An unawaited Promise passed as a prop starts the work on the server; the client reads it with **`use()`** inside `<Suspense>`.
+- An unawaited Promise passed as a prop starts the work on the server; the client reads it with [`use()`](https://react.dev/reference/react/use) inside `<Suspense>`.
 - Every prop lands in the RSC payload the browser downloads — pass only the fields the component needs, never whole database rows.
 
 ### Server Functions
 
-- **`'use server'`** marks async functions the client can call: React serializes the arguments, POSTs them, and returns the serialized result.
-- Every exported Server Function is a **public endpoint** — anyone can call it with crafted arguments, so authenticate, authorize, and validate inside each one.
-- Designed for mutations: the client dispatches them **one at a time** and their results aren't cached, so they're a poor fit for data fetching.
+- [`'use server'`](https://react.dev/reference/rsc/use-server) marks async functions the client can call: React serializes the arguments, POSTs them, and returns the serialized result.
+- Every exported [Server Function](https://react.dev/reference/rsc/server-functions) is a public endpoint — anyone can call it with crafted arguments, so authenticate, authorize, and validate inside each one.
+- Designed for mutations: the client dispatches them one at a time and their results aren't cached, so they're a poor fit for data fetching.
 - A Server Function passed to `<form action>` or `formAction`, or called inside a transition, is a Server Action.
 
 ### RSC protocol vulnerabilities
 
-- **React2Shell** (CVE-2025-55182, December 2025, CVSS **10.0**): unauthenticated remote code execution through Flight-protocol deserialization in `react-server-dom-*` 19.0.0, 19.1.0–19.1.1, and 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1), exploited within days.
-- Follow-up denial-of-service and source-code-exposure CVEs needed several more patch rounds into 2026 — stay on the latest patch of the RSC packages and the framework.
+- React2Shell ([CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components), December 2025, CVSS 10.0): unauthenticated remote code execution through Flight-protocol deserialization in `react-server-dom-*` 19.0.0, 19.1.0–19.1.1, and 19.2.0 (fixed in 19.0.1, 19.1.2, 19.2.1), exploited within days.
+- [Follow-up denial-of-service and source-code-exposure CVEs](https://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components) needed several more patch rounds into 2026 — stay on the latest patch of the RSC packages and the framework.
 - Client-only React apps were unaffected — only servers that decode RSC requests (Next.js App Router, React Router RSC mode, Waku).
 
 ## Concurrency and Suspense
 
 ### Transitions
 
-- **`startTransition`**/`useTransition` mark an update as non-urgent: it renders in the background, typing interrupts it, and the old UI stays visible; `isPending` flags it.
-- A transition can't drive a controlled input's `value` — the input update must stay urgent.
-- **`useDeferredValue(value)`** renders with the old value first and the new one in the background — for values you receive rather than set.
+- [`startTransition`](https://react.dev/reference/react/startTransition)/[`useTransition`](https://react.dev/reference/react/useTransition) mark an update as non-urgent: it renders in the background, typing interrupts it, and the old UI stays visible; `isPending` flags it.
+- A transition [can't drive a controlled input's `value`](https://react.dev/reference/react/useTransition#updating-an-input-in-a-transition-doesnt-work) — the input update must stay urgent.
+- [`useDeferredValue(value)`](https://react.dev/reference/react/useDeferredValue) renders with the old value first and the new one in the background — for values you receive rather than set.
 - An async function in `startTransition` (React 19) keeps `isPending` true until it settles; state set after an `await` needs its own `startTransition`.
-- Async transitions can finish **out of order**; `useActionState` and `<form action>` keep them in order, a hand-rolled flow needs its own queue or abort.
+- Async transitions can finish out of order; [`useActionState`](https://react.dev/reference/react/useActionState) and `<form action>` keep them in order, a hand-rolled flow needs its own queue or abort.
 
 ### Suspense boundaries
 
-- Suspense activates for `lazy`, `use(promise)`, and Suspense-enabled frameworks — **not** for fetching in an effect or event handler.
-- Content that suspends again shows the fallback again, unless the update was a **transition**, which keeps the old UI on screen.
-- Promises passed to `use` must be **cached**: one created during render is new on every render and never resolves for React ("uncached promise").
+- [Suspense](https://react.dev/reference/react/Suspense) activates for `lazy`, `use(promise)`, and Suspense-enabled frameworks — not for fetching in an effect or event handler.
+- Content that suspends again shows the fallback again, unless the update was a [transition](https://react.dev/reference/react/Suspense#preventing-already-revealed-content-from-hiding), which keeps the old UI on screen.
+- Promises passed to [`use`](https://react.dev/reference/react/use) must be cached: one created during render is new on every render and never resolves for React ("uncached promise").
 - React reveals boundaries at most once every 300 ms, so boundaries that resolve close together appear together.
 
 ### Activity
 
-- **`<Activity mode="hidden">`** (19.2) hides its children with `display: none` but keeps their state and DOM.
-- Hidden children **unmount their effects** and process updates only when React is otherwise idle; switching back to `visible` re-runs the effects.
+- [`<Activity mode="hidden">`](https://react.dev/reference/react/Activity) (19.2) hides its children with `display: none` but keeps their state and DOM.
+- Hidden children unmount their effects and process updates only when React is otherwise idle; switching back to `visible` re-runs the effects.
 - Use it for tabs that keep their state and for pre-rendering a likely next screen in the background.
 
 ### View Transitions
 
-- **`<ViewTransition>`** (stable in 19.3) animates elements on enter, exit, update, and shared-element moves with the browser View Transition API (see [frontend.md](frontend.md)).
-- It only animates updates inside a **Transition**, a Suspense reveal, or `useDeferredValue`; a plain `setState` doesn't animate.
-- `addTransitionType('next')` inside `startTransition` picks a different animation for the same element depending on the cause.
+- [`<ViewTransition>`](https://react.dev/reference/react/ViewTransition) ([stable in 19.3](https://react.dev/blog/2026/09/09/react-19-3#view-transition)) animates elements on enter, exit, update, and shared-element moves with the browser [View Transition API](https://developer.mozilla.org/en-US/docs/Web/API/View_Transition_API) (see [frontend.md](frontend.md)).
+- It only animates updates inside a Transition, a Suspense reveal, or `useDeferredValue`; a plain `setState` doesn't animate.
+- [`addTransitionType('next')`](https://react.dev/reference/react/addTransitionType) inside `startTransition` picks a different animation for the same element depending on the cause.
 
 ## Forms and Actions
 
 ### Actions
 
-- An **Action** is an async function passed to `<form action>`, `formAction`, or `startTransition`; React tracks its pending state and sends thrown errors to the nearest error boundary.
-- After a `<form action>` succeeds, React **resets uncontrolled fields** (`requestFormReset` does it manually).
-- `useActionState(action, initialState)` returns `[state, formAction, isPending]` and passes the previous state to the action as its first argument.
-- **`useFormStatus()`** reads the pending state of the parent `<form>`, so it must be called in a component rendered inside that form.
+- An Action is an async function passed to [`<form action>`](https://react.dev/reference/react-dom/components/form), `formAction`, or `startTransition`; React tracks its pending state and sends thrown errors to the nearest error boundary.
+- After a `<form action>` succeeds, React resets uncontrolled fields ([`requestFormReset`](https://react.dev/blog/2024/12/05/react-19#form-actions) does it manually).
+- [`useActionState(action, initialState)`](https://react.dev/reference/react/useActionState) returns `[state, formAction, isPending]` and passes the previous state to the action as its first argument.
+- [`useFormStatus()`](https://react.dev/reference/react-dom/hooks/useFormStatus) reads the pending state of the parent `<form>`, so it must be called in a component rendered inside that form.
 
 ### Optimistic updates
 
-- **`useOptimistic(state, updateFn)`** shows the expected result immediately while an Action runs.
+- [`useOptimistic(state, updateFn)`](https://react.dev/reference/react/useOptimistic) shows the expected result immediately while an Action runs.
 - When the Action settles, the optimistic value is dropped and the real state shows — a failure rolls back automatically.
 
 ### Controlled and uncontrolled inputs
 
-- `value={undefined}` followed by a string flips an input from uncontrolled to controlled and warns — initialize with `''`.
-- `onChange` fires on every keystroke (the native `input` event), unlike the DOM `change` event.
+- `value={undefined}` followed by a string flips an input from [uncontrolled to controlled](https://react.dev/reference/react-dom/components/input#im-getting-an-error-a-component-is-changing-an-uncontrolled-input-to-be-controlled) and warns — initialize with `''`.
+- `onChange` fires on every keystroke (the native [`input`](https://developer.mozilla.org/en-US/docs/Web/API/Element/input_event) event), unlike the DOM [`change`](https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/change_event) event.
 
 ## SSR and hydration
 
 ### Hydration mismatches
 
-- **Hydration** attaches listeners to the server HTML and expects the first client render to match it exactly.
+- [Hydration](https://react.dev/reference/react-dom/client/hydrateRoot) attaches listeners to the server HTML and expects the first client render to match it exactly.
 - Mismatch sources: `Date.now()`, `Math.random()`, `typeof window` branches, locale or timezone formatting, invalid nesting (`<div>` inside `<p>`), browser extensions.
-- A text or structure mismatch makes React throw away the server HTML and **client-render** up to the nearest Suspense boundary; a mismatched attribute isn't patched at all.
-- Fixes: **`useId`** for IDs, client-only values set in an effect, or `use(browser())` (19.3), which renders the Suspense fallback on the server and the component only on the client.
-- `suppressHydrationWarning` silences one element's attribute and text mismatches, one level deep; React still doesn't patch them.
+- A text or structure mismatch makes React throw away the server HTML and client-render up to the nearest Suspense boundary; a mismatched attribute isn't patched at all.
+- Fixes: [`useId`](https://react.dev/reference/react/useId) for IDs, client-only values set in an effect, or [`use(browser())`](https://react.dev/reference/react-dom/browser) (19.3), which renders the Suspense fallback on the server and the component only on the client.
+- [`suppressHydrationWarning`](https://react.dev/reference/react-dom/components/common#common-props) silences one element's attribute and text mismatches, one level deep; React still doesn't patch them.
 
 ### Streaming and selective hydration
 
-- `renderToPipeableStream` (Node) and `renderToReadableStream` (Web Streams) send the shell first; each Suspense boundary streams in later with an inline script that swaps it into place.
-- **Selective hydration**: boundaries hydrate independently, and one the user interacts with jumps the queue.
-- Crawlers and static generation wait for all content (`onAllReady`); browsers get the shell as soon as it's ready (`onShellReady`).
-- **Partial pre-rendering** (19.2): `prerender` produces a static prelude for the CDN, and `resume` fills in the postponed parts per request.
+- [`renderToPipeableStream`](https://react.dev/reference/react-dom/server/renderToPipeableStream) (Node) and [`renderToReadableStream`](https://react.dev/reference/react-dom/server/renderToReadableStream) (Web Streams) send the shell first; each Suspense boundary streams in later with an inline script that swaps it into place.
+- [Selective hydration](https://github.com/reactwg/react-18/discussions/37): boundaries hydrate independently, and one the user interacts with jumps the queue.
+- Crawlers and static generation [wait for all content](https://react.dev/reference/react-dom/server/renderToPipeableStream#waiting-for-all-content-to-load-for-crawlers-and-static-generation) (`onAllReady`); browsers get the shell as soon as it's ready (`onShellReady`).
+- Partial pre-rendering (19.2): [`prerender`](https://react.dev/reference/react-dom/static/prerender) produces a static prelude for the CDN, and [`resume`](https://react.dev/reference/react-dom/server/resume) fills in the postponed parts per request.
 
 ## Errors and Strict Mode
 
 ### Error boundaries
 
-- An error boundary catches errors thrown while **rendering** its subtree and shows a fallback UI instead of unmounting the whole app.
-- It's still a **class component** (`getDerivedStateFromError`, `componentDidCatch`) or the `react-error-boundary` package; there's no hook equivalent.
-- It doesn't catch errors in event handlers or async callbacks (`setTimeout`, promises) — except inside `useTransition`'s `startTransition`, whose errors do reach the boundary.
-- React 19 reports each error once through the `createRoot` options `onCaughtError` and `onUncaughtError` instead of re-throwing it.
+- An [error boundary](https://react.dev/reference/react/Component#catching-rendering-errors-with-an-error-boundary) catches errors thrown while rendering its subtree and shows a fallback UI instead of unmounting the whole app.
+- It's still a class component (`getDerivedStateFromError`, `componentDidCatch`) or the [`react-error-boundary`](https://github.com/bvaughn/react-error-boundary) package; there's no hook equivalent.
+- It doesn't catch errors in event handlers or async callbacks (`setTimeout`, promises) — except inside [`useTransition`](https://react.dev/reference/react/useTransition#displaying-an-error-to-users-with-error-boundary)'s `startTransition`, whose errors do reach the boundary.
+- React 19 reports each error once through the [`createRoot`](https://react.dev/reference/react-dom/client/createRoot#parameters) options `onCaughtError` and `onUncaughtError` instead of re-throwing it.
 
 ### Strict Mode double invocation
 
-- In development, **Strict Mode** double-calls render functions to expose impure rendering.
-- It also runs an extra effect setup → cleanup → setup cycle on mount (state kept) to expose **missing cleanup**; production skips it.
+- In development, [Strict Mode](https://react.dev/reference/react/StrictMode) double-calls render functions to expose impure rendering.
+- When it wraps the root, it also runs an extra effect setup → cleanup → setup cycle on mount (state kept) to expose [missing cleanup](https://react.dev/reference/react/StrictMode#fixing-bugs-found-by-re-running-effects-in-development); production skips it.
 
 ## DOM, events, and refs
 
 ### Synthetic events
 
-- Since **React 17**, listeners attach to the **root container**, not `document`, so several React roots or versions can coexist on a page.
-- React 17 removed event pooling; `e.persist()` is a no-op.
+- Since [React 17](https://legacy.reactjs.org/blog/2020/10/20/react-v17.html#changes-to-event-delegation), listeners attach to the root container, not `document`, so several React roots or versions can coexist on a page.
+- React 17 removed [event pooling](https://legacy.reactjs.org/docs/legacy-event-pooling.html); `e.persist()` is a no-op.
 - `onScroll` doesn't bubble since React 17.
-- `onFocus`/`onBlur` are built on `focusin`/`focusout`, so unlike the DOM events they bubble.
+- `onFocus`/`onBlur` are built on [`focusin`](https://developer.mozilla.org/en-US/docs/Web/API/Element/focusin_event)/[`focusout`](https://developer.mozilla.org/en-US/docs/Web/API/Element/focusout_event), so unlike the DOM events they bubble.
 
 ### Portals
 
-- `createPortal(children, node)` renders into another DOM node, so modals and tooltips escape `overflow: hidden` and parent stacking contexts.
-- Events bubble through the **React tree**, not the DOM tree: a click inside a portal reaches the React parent's `onClick`.
+- [`createPortal(children, node)`](https://react.dev/reference/react-dom/createPortal) renders into another DOM node, so modals and tooltips escape `overflow: hidden` and parent stacking contexts.
+- Events bubble through the React tree, not the DOM tree: a click inside a portal reaches the React parent's `onClick`.
 - Context flows into a portal like into any other child.
 
 ### Refs
 
-- `ref` is a regular prop for function components since **React 19** — `forwardRef` is no longer needed.
-- A callback ref gets the node on attach; since React 19 it can return a **cleanup** function instead of being called with `null` on detach.
-- `useImperativeHandle` exposes a narrow API (`focus()`, `scrollTo()`) instead of the raw DOM node.
-- **Fragment refs** (19.3): `<Fragment ref>` gives focus, event-listener, and observer methods over a group of children without a wrapper element.
+- [`ref` is a regular prop](https://react.dev/blog/2024/12/05/react-19#ref-as-a-prop) for function components since React 19 — [`forwardRef`](https://react.dev/reference/react/forwardRef) is no longer needed.
+- A callback ref gets the node on attach; since React 19 it can return a [cleanup function](https://react.dev/blog/2024/12/05/react-19#cleanup-functions-for-refs) instead of being called with `null` on detach.
+- [`useImperativeHandle`](https://react.dev/reference/react/useImperativeHandle) exposes a narrow API (`focus()`, `scrollTo()`) instead of the raw DOM node.
+- [Fragment refs](https://react.dev/reference/react/Fragment) (19.3): `<Fragment ref>` gives focus, event-listener, and observer methods over a group of children without a wrapper element.
 
 ## Version changes
 
 ### React 18
 
-- **`createRoot`** turns on concurrent features; the legacy `ReactDOM.render` kept React 17 behavior.
-- Added automatic batching everywhere, `useTransition`/`useDeferredValue`, and Suspense on the server (streaming SSR, selective hydration).
+- [`createRoot`](https://react.dev/reference/react-dom/client/createRoot) turns on concurrent features; the legacy `ReactDOM.render` kept React 17 behavior.
+- Added automatic batching everywhere, `useTransition`/`useDeferredValue`, and Suspense on the server (streaming SSR, selective hydration) — [React 18 release notes](https://react.dev/blog/2022/03/29/react-v18).
 - Added `useId`, `useSyncExternalStore`, and `useInsertionEffect`; Strict Mode started double-running effects in development.
 
 ### React 19
 
-- Added `<Context>` as a provider and `<title>`/`<meta>`/`<link>` hoisted into `<head>` from any component, alongside **Actions**, `use`, and `ref` as a prop.
-- Removed `ReactDOM.render`/`hydrate`, string refs, legacy context, `propTypes`, and **`defaultProps`** on function components (use default parameters).
-- Server Components and Server Functions are stable for apps, but the bundler APIs underneath don't follow semver, so frameworks pin React versions.
+- Added [`<Context>` as a provider](https://react.dev/blog/2024/12/05/react-19#context-as-a-provider) and `<title>`/`<meta>`/`<link>` [hoisted into `<head>`](https://react.dev/blog/2024/12/05/react-19#support-for-metadata-tags) from any component, alongside Actions, `use`, and `ref` as a prop.
+- [Removed](https://react.dev/blog/2024/04/25/react-19-upgrade-guide#removed-deprecated-react-apis) `ReactDOM.render`/`hydrate`, string refs, legacy context, `propTypes`, and `defaultProps` on function components (use default parameters).
+- Server Components and Server Functions are stable for apps, but the [bundler APIs underneath don't follow semver](https://react.dev/reference/rsc/server-components), so frameworks pin React versions.
diff --git a/docs/topics/security.md b/docs/topics/security.md
index 3a879ad..fe19c3d 100644
--- a/docs/topics/security.md
+++ b/docs/topics/security.md
@@ -6,146 +6,146 @@ What experienced engineers forget about application security before an interview
 
 ### SQL injection
 
-- Untrusted input becomes SQL syntax. Fix with **parameterized queries**, not hand escaping.
-- Identifiers (sort column, table name) can't be bound — **allowlist** them; ORMs don't protect raw fragments.
+- Untrusted input becomes SQL syntax ([SQL injection](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)). Fix with [parameterized queries](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html), not hand escaping.
+- Identifiers (sort column, table name) can't be bound — allowlist them; ORMs don't protect raw fragments.
 
 ### Command and template injection
 
-- **Command injection**: input inside a shell string (`system("convert " + name)`) — pass an argument array with no shell.
-- **SSTI**: user input compiled as a template (Jinja2, Twig) runs code on the server — pass it only as template data.
-- **XXE**: XML parsers resolving external entities read local files or make requests — disable DTDs and external entities.
+- [Command injection](https://cheatsheetseries.owasp.org/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.html): input inside a shell string (`system("convert " + name)`) — pass an argument array with no shell.
+- [SSTI](https://portswigger.net/web-security/server-side-template-injection): user input compiled as a template (Jinja2, Twig) runs code on the server — pass it only as template data.
+- [XXE](https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html): XML parsers resolving external entities read local files or make requests — disable DTDs and external entities.
 
 ### Path traversal and unsafe deserialization
 
-- **Path traversal**: `../../etc/passwd` in a filename escapes the base directory — resolve the canonical path and check it's still inside the base, or map IDs to files.
-- **Unsafe deserialization** (Java serialization, Python `pickle`, YAML with object tags) runs attacker-chosen code — only deserialize untrusted input into plain data (JSON) with schema validation.
+- [Path traversal](https://community.owasp.org/attacks/Path_Traversal): `../../etc/passwd` in a filename escapes the base directory — resolve the canonical path and check it's still inside the base, or map IDs to files.
+- [Unsafe deserialization](https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html) (Java serialization, Python [`pickle`](https://docs.python.org/3/library/pickle.html), YAML with object tags) runs attacker-chosen code — only deserialize untrusted input into plain data (JSON) with schema validation.
 
 ### SSRF
 
-- The attacker controls where the server sends a request — reaching cloud metadata or internal services.
-- Allowlist destinations, validate the **resolved IP**, and pin it for the request to avoid **DNS rebinding**.
-- **IMDSv2** on AWS requires a session token, blocking naive metadata theft.
+- The attacker controls where the server sends a request — reaching cloud metadata or internal services ([SSRF](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)).
+- Allowlist destinations, validate the resolved IP, and pin it for the request to avoid [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding).
+- [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) on AWS requires a session token, blocking naive metadata theft.
 
 ### Prototype pollution
 
-- Merging untrusted JSON with `__proto__` or `constructor.prototype` keys adds properties to **`Object.prototype`** — every object gains them, so checks like `if (user.isAdmin)` can flip.
-- Reject those keys, parse into `Map` or `Object.create(null)`, or freeze the prototype.
+- Merging untrusted JSON with `__proto__` or `constructor.prototype` keys adds properties to `Object.prototype` ([prototype pollution](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution)) — every object gains them, so checks like `if (user.isAdmin)` can flip.
+- Reject those keys, parse into [`Map`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Map) or [`Object.create(null)`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/create), or [freeze](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze) the prototype.
 
 ### HTTP request smuggling
 
-- A proxy and the backend disagree on where a request ends (**`Content-Length` vs `Transfer-Encoding`**), so attacker bytes become the start of the next user's request.
+- A proxy and the backend disagree on where a request ends ([`Content-Length` vs `Transfer-Encoding`](https://www.rfc-editor.org/rfc/rfc9112#section-6.3)), so attacker bytes become the start of the next user's request ([request smuggling](https://portswigger.net/web-security/request-smuggling)).
 - Reject ambiguous requests at the edge, use HTTP/2 end to end, and keep proxies patched.
 
 ### Resource-exhaustion attacks
 
-- **ReDoS**: backtracking regex engines take exponential time on patterns like `(a+)+$` with crafted input; use linear-time engines (RE2, Go `regexp`, Rust `regex`) or match timeouts.
-- Decompression bombs and XML **billion laughs** expand kilobytes into gigabytes — cap the decompressed size and disable entity expansion.
-- Hash flooding sends colliding keys that make hash tables O(n) per operation; runtimes defend with randomized hash seeds (SipHash).
-- Cap JSON nesting depth, GraphQL query depth and cost, and request sizes at the edge.
+- [ReDoS](https://community.owasp.org/attacks/Regular_expression_Denial_of_Service_-_ReDoS): backtracking regex engines take exponential time on patterns like `(a+)+$` with crafted input; use linear-time engines ([RE2](https://github.com/google/re2/wiki/Syntax), Go [`regexp`](https://pkg.go.dev/regexp), Rust [`regex`](https://docs.rs/regex/latest/regex/)) or match timeouts.
+- [Decompression bombs](https://en.wikipedia.org/wiki/Zip_bomb) and XML [billion laughs](https://en.wikipedia.org/wiki/Billion_laughs_attack) expand kilobytes into gigabytes — cap the decompressed size and disable entity expansion.
+- [Hash flooding](https://en.wikipedia.org/wiki/Collision_attack#Hash_flooding) sends colliding keys that make hash tables O(n) per operation; runtimes defend with randomized hash seeds ([SipHash](https://en.wikipedia.org/wiki/SipHash)).
+- Cap JSON nesting depth, [GraphQL query depth and cost](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html), and request sizes at the edge.
 
 ## Browser-side attacks
 
 ### XSS
 
-- **Stored** (saved, rendered later), **reflected** (echoed in the response), **DOM-based** (client code turns data into markup or script).
-- Fix with context-aware output encoding and safe sinks (`textContent`, not `innerHTML`); CSP limits damage but isn't the primary fix.
+- [XSS](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS) is stored (saved, rendered later) or reflected (echoed in the response); [DOM-based](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html) means client code turns data into markup or script, and its payload can be stored or reflected too.
+- Fix with [context-aware output encoding](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) and safe sinks ([`textContent`](https://developer.mozilla.org/en-US/docs/Web/API/Node/textContent), not [`innerHTML`](https://developer.mozilla.org/en-US/docs/Web/API/Element/innerHTML)); CSP limits damage but isn't the primary fix.
 
 ### Content Security Policy
 
-- A **strict CSP** uses per-response nonces or hashes (`script-src 'nonce-…' 'strict-dynamic'`); host allowlists are routinely bypassed through JSONP endpoints and CDN-hosted gadgets.
-- **`'strict-dynamic'`** lets a trusted script load further scripts and makes supporting browsers ignore host allowlists.
-- **`frame-ancestors`** blocks framing, which stops clickjacking (a hidden frame tricking the user into clicking the real site); `X-Frame-Options` is the legacy header.
-- Roll out with `Content-Security-Policy-Report-Only` first.
+- A [strict CSP](https://web.dev/articles/strict-csp) uses per-response nonces or hashes (`script-src 'nonce-…' 'strict-dynamic'`); host allowlists are routinely bypassed through JSONP endpoints and CDN-hosted gadgets.
+- [`'strict-dynamic'`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src#strict-dynamic) lets a trusted script load further scripts and makes supporting browsers ignore host allowlists.
+- [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors) blocks framing, which stops [clickjacking](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Clickjacking) (a hidden frame tricking the user into clicking the real site); [`X-Frame-Options`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) is the legacy header.
+- Roll out with [`Content-Security-Policy-Report-Only`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy-Report-Only) first.
 
 ### CSRF
 
-- The browser auto-attaches cookies to a forged cross-site request.
-- Defend with framework **CSRF tokens** plus `SameSite=Lax`/`Strict` cookies (**Lax is Chrome's default**); XSS defeats CSRF defenses, so it's no substitute.
+- The browser auto-attaches cookies to a forged cross-site request ([CSRF](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF)).
+- Defend with framework [CSRF tokens](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html) plus [`SameSite=Lax`/`Strict`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) cookies ([Lax is Chrome's default](https://www.chromium.org/updates/same-site/)); XSS bypasses CSRF defenses, so prevent XSS separately.
 
 ### CORS
 
-- CORS is a **browser read policy**, not authentication or a firewall — non-browser clients ignore it.
-- A credentialed response can't use `Access-Control-Allow-Origin: *`; reflecting any `Origin` with credentials is equivalent to no policy.
-- **Simple requests** (GET, HEAD, or POST with a form or `text/plain` body and no custom headers) go out without a preflight: the server acts on them even though the browser hides the response, so CORS is no CSRF defense.
-- Other requests are **preflighted** with `OPTIONS`; `Access-Control-Max-Age` caches the result.
+- [CORS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS) is a browser read policy, not authentication or a firewall — non-browser clients ignore it.
+- A credentialed response can't use [`Access-Control-Allow-Origin: *`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Allow-Origin); reflecting any `Origin` with credentials is equivalent to no policy.
+- [Simple requests](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#simple_requests) (GET, HEAD, or POST with a form or `text/plain` body and no custom headers) go out without a preflight: the server acts on them even though the browser hides the response, so CORS is no CSRF defense.
+- Other requests are [preflighted](https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request) with `OPTIONS`; [`Access-Control-Max-Age`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Access-Control-Max-Age) caches the result.
 
 ### Open redirect
 
-- `/login?next=https://evil.example` sends victims to a phishing page through a link on your domain, and can leak OAuth codes.
-- Allow only **relative paths** or an allowlist of hosts.
+- `/login?next=https://evil.example` sends victims to a phishing page through a link on your domain, and can leak OAuth codes ([open redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html)).
+- Resolve the target against your origin and require the result to stay same-origin (`//evil.example` is a relative [network-path reference](https://www.rfc-editor.org/rfc/rfc3986#section-4.2) to another host), or check it against an allowlist of hosts.
 
 ## Authentication and sessions
 
 ### Password storage
 
-- Use a slow, memory-hard hash — **argon2id**, else scrypt — never a fast hash like SHA-256; store algorithm and parameters with the hash.
-- bcrypt is for legacy systems only: not memory-hard, and input is capped at 72 bytes (some libraries truncate silently, others reject — Python `bcrypt` 5.0+).
-- A unique **salt** per password defeats rainbow tables; a **pepper** (server-side secret stored elsewhere) helps if only the database leaks.
+- Use a slow, memory-hard hash — [argon2id](https://www.rfc-editor.org/rfc/rfc9106), else [scrypt](https://www.rfc-editor.org/rfc/rfc7914) — never a fast hash like SHA-256; store algorithm and parameters with the hash ([OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html)).
+- [bcrypt](https://en.wikipedia.org/wiki/Bcrypt) is for legacy systems only: not memory-hard, and input is capped at 72 bytes (some libraries truncate silently, others reject — Python [`bcrypt`](https://pypi.org/project/bcrypt/) 5.0+).
+- A unique [salt](https://en.wikipedia.org/wiki/Salt_%28cryptography%29) per password defeats [rainbow tables](https://en.wikipedia.org/wiki/Rainbow_table); a [pepper](https://en.wikipedia.org/wiki/Pepper_%28cryptography%29) (server-side secret stored elsewhere) helps if only the database leaks.
 
 ### Password policy (NIST SP 800-63B)
 
-- Rev. 4 (2025): minimum **15 characters** for password-only login (8 with MFA), allow at least 64, **no composition rules**, no forced periodic rotation.
-- Check new passwords against breached-password lists; rotate only on evidence of compromise.
+- [Rev. 4](https://pages.nist.gov/800-63-4/sp800-63b.html) (2025): minimum 15 characters for password-only login (8 with MFA), allow at least 64, no composition rules, no forced periodic rotation.
+- Check new passwords against breached-password lists ([Pwned Passwords](https://haveibeenpwned.com/Passwords)); rotate only on evidence of compromise.
 
 ### Credential stuffing and enumeration
 
-- **Credential stuffing** replays leaked username/password pairs: rate-limit per account and per IP, add MFA, and check logins against breached-password lists.
-- Return the same error and similar timing for "no such user" and "wrong password" to avoid **account enumeration**.
+- [Credential stuffing](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html) replays leaked username/password pairs: rate-limit per account and per IP, add MFA, and check logins against breached-password lists.
+- Return the same error and similar timing for "no such user" and "wrong password" to avoid [account enumeration](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html#authentication-and-error-messages).
 
 ### MFA strength
 
-- Phishing resistance: **WebAuthn/passkeys** > TOTP app > SMS (SIM swap).
-- A passkey's private key never reaches the server (synced passkeys copy it end-to-end encrypted between the user's devices), and its signature covers the **origin**, so a lookalike domain gets nothing usable.
+- Phishing resistance: [WebAuthn](https://www.w3.org/TR/webauthn-3/)/[passkeys](https://passkeys.dev/) > [TOTP](https://www.rfc-editor.org/rfc/rfc6238) app > SMS ([SIM swap](https://en.wikipedia.org/wiki/SIM_swap_scam)).
+- A passkey's private key never reaches the server (synced passkeys copy it end-to-end encrypted between the user's devices), and its signature covers the origin, so a lookalike domain gets nothing usable.
 
 ### Cookie flags
 
-- **`HttpOnly`** (no JS access), **`Secure`** (HTTPS only), `SameSite` (cross-site sending).
-- The **`__Host-`** prefix forces `Secure`, path `/`, and no `Domain`, blocking cookie injection from subdomains.
+- [`HttpOnly`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#httponly) (no JS access), [`Secure`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#secure) (HTTPS only), [`SameSite`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#samesitesamesite-value) (cross-site sending).
+- The [`__Host-` prefix](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#cookie_prefixes) forces `Secure`, path `/`, and no `Domain`, blocking cookie injection from subdomains.
 
 ### Session fixation
 
-- An attacker plants a known session ID before login, then shares the victim's session once they authenticate.
-- Always **issue a new session ID** on authentication and privilege change.
+- An attacker plants a known session ID before login, then shares the victim's session once they authenticate ([session fixation](https://community.owasp.org/attacks/Session_fixation)).
+- Always [issue a new session ID](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#renew-the-session-id-after-any-privilege-level-change) on authentication and privilege change.
 
 ### Password reset and recovery
 
-- Reset tokens are single-use, short-lived, high-entropy, and **stored hashed** like passwords.
+- Reset tokens are single-use, short-lived, high-entropy, and stored hashed like passwords ([OWASP](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html)).
 - Respond identically whether or not the account exists; revoke other sessions after a reset.
-- Build the reset link from a configured origin, never the request's `Host` header — **host-header poisoning** sends the token to the attacker's domain.
+- Build the reset link from a configured origin, never the request's `Host` header — [host-header poisoning](https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning) sends the token to the attacker's domain.
 - Recovery is often the weakest login path (SIM swap, support-desk social engineering): hold it to the same assurance as MFA.
 
 ### Browser token storage
 
-- **`HttpOnly` cookie**: safe from XSS token theft, needs `SameSite` + CSRF tokens — the default for web apps.
+- [`HttpOnly`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie#httponly) cookie: safe from XSS token theft, needs `SameSite` + CSRF tokens — the default for web apps.
 - In memory: no CSRF, gone on refresh (needs silent refresh), still usable by a script running on the page.
-- **`localStorage`**: any XSS reads it directly — avoid for sensitive tokens.
+- [`localStorage`](https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage): any XSS reads it directly — avoid for sensitive tokens.
 
 ## Tokens and federation
 
 ### JWT validation
 
-- Pin the expected **`alg`**, reject `none`, and block **RS/HS confusion** (an RS256 token re-signed as HS256 with the public key as the secret).
-- Pick the key by `kid` from a trusted set; validate `exp`, `aud`, and `iss` — a valid signature is not authorization.
+- Pin the expected [`alg`](https://www.rfc-editor.org/rfc/rfc8725#section-3.1), reject `none`, and block [RS/HS confusion](https://portswigger.net/web-security/jwt/algorithm-confusion) (an RS256 token re-signed as HS256 with the public key as the secret).
+- Pick the key by `kid` from a trusted set ([JWKS](https://www.rfc-editor.org/rfc/rfc7517)); validate [`exp`, `aud`, and `iss`](https://www.rfc-editor.org/rfc/rfc7519#section-4.1) — a valid signature is not authorization.
 
 ### JWT revocation
 
-- Stateless tokens can't be revoked in place — use **short expiry** plus refresh-token rotation.
-- A denylist of token IDs works but brings back a server-side lookup on every request.
+- Stateless [JWTs](https://www.rfc-editor.org/rfc/rfc7519) can't be revoked in place — use short expiry plus [refresh-token rotation](https://www.rfc-editor.org/rfc/rfc9700#section-4.14.2).
+- A denylist of token IDs ([`jti`](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7)) works but brings back a server-side lookup on every request.
 
 ### OAuth 2.0 vs OIDC
 
-- **OAuth 2.0** is delegated authorization (an access token for a resource server); **OIDC** adds authentication via an ID token.
-- Interactive login: **authorization code + PKCE**; service to service: client credentials. OAuth 2.1 drops the implicit and password grants.
+- [OAuth 2.0](https://www.rfc-editor.org/rfc/rfc6749) is delegated authorization (an access token for a resource server); [OIDC](https://openid.net/specs/openid-connect-core-1_0.html) adds authentication via an ID token.
+- Interactive login: authorization code + [PKCE](https://www.rfc-editor.org/rfc/rfc7636); service to service: [client credentials](https://www.rfc-editor.org/rfc/rfc6749#section-4.4). [OAuth 2.1](https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/) drops the implicit and password grants.
 
 ### OAuth pitfalls
 
-- Match **`redirect_uri` exactly** against a registered value — prefix or wildcard matching leaks authorization codes.
-- The **`state`** parameter (or PKCE) ties the callback to the browser session that started it, blocking login CSRF.
-- Bearer tokens work for whoever holds them; **DPoP** or mTLS sender-constrains tokens to a client key.
+- Match `redirect_uri` exactly against a registered value — prefix or wildcard matching [leaks authorization codes](https://www.rfc-editor.org/rfc/rfc9700#section-4.1).
+- The [`state`](https://www.rfc-editor.org/rfc/rfc6749#section-10.12) parameter (or PKCE) ties the callback to the browser session that started it, blocking login CSRF.
+- Bearer tokens work for whoever holds them; [DPoP](https://www.rfc-editor.org/rfc/rfc9449) or [mTLS](https://www.rfc-editor.org/rfc/rfc8705) sender-constrains tokens to a client key.
 
 ### Refresh token rotation
 
-- Each refresh returns a **new refresh token** and invalidates the old one.
+- Each refresh returns a new refresh token and invalidates the old one ([RFC 9700](https://www.rfc-editor.org/rfc/rfc9700#section-4.14.2)).
 - Reuse of an old token signals theft, so revoke the whole token family.
 
 ## Authorization
@@ -154,87 +154,87 @@ What experienced engineers forget about application security before an interview
 
 | Model | Decision based on | Fits | Weak spot |
 |---|---|---|---|
-| RBAC | roles | few, stable roles | role explosion from exceptions |
-| ABAC | subject/resource/context attributes | fine-grained conditions | needs trustworthy attributes |
-| ReBAC | relationship graph ("member of team that owns") | nested sharing (Google Docs, Zanzibar) | graph storage and evaluation cost |
+| [RBAC](https://en.wikipedia.org/wiki/Role-based_access_control) | roles | few, stable roles | role explosion from exceptions |
+| [ABAC](https://en.wikipedia.org/wiki/Attribute-based_access_control) | subject/resource/context attributes | fine-grained conditions | needs trustworthy attributes |
+| [ReBAC](https://en.wikipedia.org/wiki/Relationship-based_access_control) | relationship graph ("member of team that owns") | nested sharing (Google Docs, [Zanzibar](https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/)) | graph storage and evaluation cost |
 
-- Enforce **server-side** and **deny by default** — a hidden button is not access control.
+- Enforce server-side and [deny by default](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html#deny-by-default) — a hidden button is not access control.
 
 ### IDOR / BOLA
 
-- The endpoint checks that the caller is logged in but not that they may access **this object ID**.
-- Authorize per resource on every request; unguessable IDs only hide the bug.
+- The endpoint checks that the caller is logged in but not that they may access this object ID ([BOLA](https://api-security.owasp.org/editions/2023/en/0xa1-broken-object-level-authorization/)).
+- Authorize per resource on every request; unguessable IDs only hide the bug ([IDOR](https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html)).
 
 ## Cryptography
 
 ### Secure randomness
 
-- Tokens, session IDs, nonces, and reset codes need a **CSPRNG**: `crypto.getRandomValues`/`crypto.randomBytes`, Python `secrets`, Go `crypto/rand`.
-- `Math.random`, Python `random` (Mersenne Twister, reconstructable from 624 outputs), and Go `math/rand` aren't designed for secrets.
-- Use at least **128 bits** for unguessable tokens.
+- Tokens, session IDs, nonces, and reset codes need a [CSPRNG](https://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator): [`crypto.getRandomValues`](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues)/[`crypto.randomBytes`](https://nodejs.org/api/crypto.html#cryptorandombytessize-callback), Python [`secrets`](https://docs.python.org/3/library/secrets.html), Go [`crypto/rand`](https://pkg.go.dev/crypto/rand).
+- [`Math.random`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Math/random), Python [`random`](https://docs.python.org/3/library/random.html) ([Mersenne Twister](https://en.wikipedia.org/wiki/Mersenne_Twister), reconstructable from 624 outputs), and Go [`math/rand`](https://pkg.go.dev/math/rand) aren't designed for secrets.
+- Use at least 128 bits for unguessable tokens.
 
 ### AES-GCM nonces
 
-- **AES-GCM** is authenticated encryption: confidentiality plus an integrity tag.
-- **Reusing a nonce with the same key** breaks both — nonces must never repeat per key; random 96-bit nonces are safe for about 2³² messages per key.
+- [AES-GCM](https://en.wikipedia.org/wiki/Galois/Counter_Mode) is [authenticated encryption](https://en.wikipedia.org/wiki/Authenticated_encryption): confidentiality plus an integrity tag.
+- Reusing a nonce with the same key breaks both — nonces must never repeat per key; random 96-bit nonces are safe for about 2³² messages per key ([NIST SP 800-38D](https://csrc.nist.gov/pubs/sp/800/38/d/final)).
 
 ### RSA vs ECC and forward secrecy
 
-- ECC gives equal security at far smaller keys (**256-bit EC ≈ 3072-bit RSA**), making signatures and handshakes cheaper.
-- **ECDHE** gives **forward secrecy**: a later leak of the long-term key doesn't expose past sessions.
+- [ECC](https://en.wikipedia.org/wiki/Elliptic-curve_cryptography) gives equal security at far smaller keys (256-bit EC ≈ 3072-bit RSA, [NIST SP 800-57](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final)), making signatures and handshakes cheaper.
+- [ECDHE](https://en.wikipedia.org/wiki/Elliptic-curve_Diffie%E2%80%93Hellman) gives [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy): a later leak of the long-term key doesn't expose past sessions.
 
 ### MAC vs signature
 
-- A **MAC** (HMAC) proves integrity to anyone holding the shared key, so it can't give non-repudiation; a **signature** can, since only the private-key holder could sign.
-- Naive `hash(key ‖ msg)` is open to **length extension** on Merkle-Damgård hashes (MD5, SHA-1, SHA-256); HMAC isn't.
+- A [MAC](https://en.wikipedia.org/wiki/Message_authentication_code) ([HMAC](https://www.rfc-editor.org/rfc/rfc2104)) proves integrity to anyone holding the shared key, so it can't give [non-repudiation](https://en.wikipedia.org/wiki/Non-repudiation); a [signature](https://en.wikipedia.org/wiki/Digital_signature) can, since only the private-key holder could sign.
+- Naive `hash(key ‖ msg)` is open to [length extension](https://en.wikipedia.org/wiki/Length_extension_attack) on [Merkle-Damgård](https://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_construction) hashes (MD5, SHA-1, SHA-256); HMAC isn't.
 
 ### Envelope encryption and key management
 
-- Encrypt data with a random **data key (DEK)**, encrypt the DEK with a **key-encryption key (KEK)** held in a KMS/HSM, store the wrapped DEK with the data.
-- Rotating the KEK only rewraps DEKs, not the data; the master key never leaves the KMS. AWS specifics: see [aws.md](aws.md).
+- Encrypt data with a random data key (DEK), encrypt the DEK with a key-encryption key (KEK) held in a KMS/[HSM](https://en.wikipedia.org/wiki/Hardware_security_module), store the wrapped DEK with the data ([envelope encryption](https://docs.cloud.google.com/kms/docs/envelope-encryption)).
+- Rotating the KEK never re-encrypts the data: KMS keeps old key versions to unwrap existing DEKs, and retiring one only means rewrapping DEKs; the master key never leaves the KMS. AWS specifics: see [aws.md](aws.md).
 
 ### Timing attacks
 
-- Comparing secrets (HMACs, tokens) with `==` returns early at the first differing byte, leaking how much matched.
-- Use a **constant-time compare** (`hmac.compare_digest`, `crypto.timingSafeEqual`).
+- Comparing secrets (HMACs, tokens) with `==` returns early at the first differing byte, leaking how much matched ([timing attack](https://en.wikipedia.org/wiki/Timing_attack)).
+- Use a constant-time compare ([`hmac.compare_digest`](https://docs.python.org/3/library/hmac.html#hmac.compare_digest), [`crypto.timingSafeEqual`](https://nodejs.org/api/crypto.html#cryptotimingsafeequala-b)).
 
 ## TLS
 
 ### TLS 1.3 handshake
 
-- **1-RTT** full handshake: key shares go in the first flight.
-- Optional **0-RTT** resumption data can be **replayed** — accept it only for requests safe to repeat (idempotent and cheap); HTTP servers can answer `425 Too Early`.
+- [TLS 1.3](https://www.rfc-editor.org/rfc/rfc8446) does a 1-RTT full handshake: key shares go in the first flight.
+- Optional [0-RTT](https://www.rfc-editor.org/rfc/rfc8446#section-2.3) resumption data can be replayed — accept it only for requests safe to repeat (idempotent and cheap); HTTP servers can answer [`425 Too Early`](https://www.rfc-editor.org/rfc/rfc8470#section-5.2).
 
 ### Post-quantum key exchange
 
-- **Harvest now, decrypt later** makes key exchange the urgent part: browsers and CDNs negotiate hybrid **X25519MLKEM768** (classical + ML-KEM, FIPS 203) by default since 2024–2025.
-- Post-quantum signatures (ML-DSA, FIPS 204) are slower to roll out because certificates and chains grow much larger.
+- [Harvest now, decrypt later](https://en.wikipedia.org/wiki/Harvest_now,_decrypt_later) makes key exchange the urgent part: browsers and CDNs negotiate hybrid [X25519MLKEM768](https://www.rfc-editor.org/rfc/rfc10024) (classical + ML-KEM, [FIPS 203](https://csrc.nist.gov/pubs/fips/203/final)) by default since 2024–2025.
+- Post-quantum signatures (ML-DSA, [FIPS 204](https://csrc.nist.gov/pubs/fips/204/final)) are slower to roll out because certificates and chains grow much larger.
 
 ### Certificates and mTLS
 
-- The client validates the **chain to a trusted root** and the hostname; the server proves key ownership by signing the handshake.
-- **mTLS**: both sides present certificates — common for service-to-service auth in a mesh.
+- The client validates the [chain to a trusted root](https://en.wikipedia.org/wiki/Chain_of_trust) and the hostname; the server proves key ownership by signing the handshake.
+- [mTLS](https://en.wikipedia.org/wiki/Mutual_authentication#mTLS): both sides present certificates — common for service-to-service auth in a mesh.
 
 ### HSTS and pinning
 
-- **HSTS** forces HTTPS on later visits after one HTTPS response (preload lists cover the first visit).
-- **Certificate pinning** resists CA compromise but makes key rotation painful — mostly limited to mobile apps now.
+- [HSTS](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security) forces HTTPS on later visits after one HTTPS response ([preload lists](https://hstspreload.org/) cover the first visit).
+- [Certificate pinning](https://cheatsheetseries.owasp.org/cheatsheets/Pinning_Cheat_Sheet.html) resists CA compromise but makes key rotation painful — mostly limited to mobile apps now.
 
 ## Secure development
 
 ### Dependency attacks
 
-- **Typosquatting** (a lookalike package name) and **dependency confusion** (a public package shadowing an internal name) trick installers.
-- Pin dependencies with lock files and hashes; install scripts run arbitrary code, so disable them where possible.
+- [Typosquatting](https://en.wikipedia.org/wiki/Typosquatting) (a lookalike package name) and [dependency confusion](https://owasp.org/www-project-top-10-ci-cd-security-risks/CICD-SEC-03-Dependency-Chain-Abuse) (a public package shadowing an internal name) trick installers.
+- Pin dependencies with lock files and hashes; [install scripts](https://docs.npmjs.com/cli/v11/using-npm/scripts) run arbitrary code, so disable them where possible.
 
 ### Provenance and signing
 
-- An **SBOM** (SPDX, CycloneDX) lists what's inside an artifact, so a new CVE can be matched to affected builds.
-- **SLSA** levels grade build provenance; **Sigstore** (cosign) signs artifacts with short-lived keys tied to a CI identity.
+- An [SBOM](https://www.cisa.gov/topics/information-communications-technology-supply-chain-security/sbom) ([SPDX](https://spdx.dev/), [CycloneDX](https://cyclonedx.org/)) lists what's inside an artifact, so a new CVE can be matched to affected builds.
+- [SLSA](https://slsa.dev/) levels grade build provenance; [Sigstore](https://www.sigstore.dev/) ([cosign](https://docs.sigstore.dev/cosign/signing/overview/)) signs artifacts with short-lived keys tied to a CI identity.
 
 ### STRIDE
 
-| STRIDE threat | Violates |
+| [STRIDE](https://en.wikipedia.org/wiki/STRIDE_model) threat | Violates |
 |---|---|
 | Spoofing | Authentication |
 | Tampering | Integrity |