Skip to main content
Welcome to the engineering team at Polar! This handbook covers our engineering practices, principles, and processes. Last reviewed: 2026-09-23. Review this page at least once a year. When you do, read the architecture decisions and check that the links below still match how we build.

​
Our Tech Stack

​
Core Technologies

  • Frontend: React, TypeScript, Next.js
  • Backend: Python, FastAPI, PostgreSQL
  • Infrastructure: Docker, Render
  • Tools: GitHub, Linear, Slack

​
Development Workflow

  1. Planning: Features planned in Linear
  2. Development: Feature branches, regular commits, AI-assisted coding
  3. Review: If the change needs a design document, fill in Security considerations, review that pull request first, then the code pull request. Other changes are a normal pull request.
  4. Testing: Automated tests + manual QA
  5. Deployment: A CI and CD pipeline for automated deployment.

​
Standards we follow

Standing rules live in architecture decision records. An accepted ADR is binding, so read it before you change a pattern it covers. Cubic and /polar-code-review check each pull request against these ADRs. A teammate may still approve the change if it’s low risk. Request and response bodies are validated with Pydantic schemas, as described in the REST API guidelines. React and the API serializers encode output. Protected endpoints use a typed AuthSubject and scopes. See authorization and ADR-0005. Give the caller the minimum access they need. Secrets are envelope-encrypted (ADR-0008). Signing keys live in KMS (ADR-0010).

​
Dependencies

Dependabot opens update pull requests every week. Review them. Do not add or keep a dependency with a known vulnerability you are not fixing. A new dependency must use a license compatible with Apache 2.0.

​
Resources