Understanding source code management, collaboration workflows, and version control practices might.

That's not important for newcomers. They'll learn about it on their first job. What matters is if they know the fundamentals of programming in whatever domain they're applying to.

Okay.

@june23 What do those “frameworks” have to do with an application? They’re just cloud providers. They have services that you would deploy and run code on. Yes, you can use. You can also create and host a web application without them.

Your question is basically: “Can I make a journey with these vehicles? Car, van, truck.”

You need to get out of this rut of, “if I use X then I will be a proper developer”. You should be using things when it makes sense to use them; not as a box-checking exercise.

Knowing how to click around GitHub won't get you the job. Understanding source code management, collaboration workflows, and version control practices might.

Just that alone is one out of many tool sets an employer will be looking for.

Yes, it absolutely applies to aspiring developers. In fact, it’s one of the best ways to break the "need experience to get experience" loop. When you don't have a formal work history, open-source contributions serve as your proof of competence. It shows a hiring manager that you can actually collaborate, handle feedback in code reviews, and navigate a massive, existing architecture things a solo portfolio project rarely demonstrates.

And this is for web developers who have never had work experience in web development? I know it can be for getting other web development jobs in other companies once you have a role in a company, but can this apply for aspired web developers, someone who has never had an actual job, just learning and wanting to get a job in web development? And also if I were to get hired by a open source company by contributing to the project will this experience I gain there as my first role get me to a better company that is not open source company like Shopify the actual company?

Yes, absolutely possible. Honestly, having actual merged PRs in public repositories often carries more weight than a degree because it proves you know how to read someone else's codebase, use Git properly, and handle code reviews

Is this possible? And if so how many pull requests do I need to get hired for a company that is open source a month, and if I fix issues in these open source companies can I get a job there?

So if I decide to follow the aws well-architected best practices (...) I will be able to deploy my Laravel/Nextjs to the EC2 server through SSH or through Github Actions?

These questions make no sense. You can deploy apps through GitHub actions or over SSH. AWS guidelines, let alone KPIs, have nothing to do with it.

I don't think I've seen you (@june92 or @june23) ask a single programming-related question on this forum. But you keep bringing up terms and buzzwords in wrong contexts. Reading random articles without understanding the context isn't learning.

Have you ever finished a complete app with Laravel? You should start with that.

I am learning system design, NFRs, UX case studies, and Security Assurance Programs like OWASP SAMM for example. I have been trying to understand if this how you get a KPI for NFRs, and I have been trying to figure out is if I use Business Impact Analysis, Service Impact Analysis, Risk Analysis?

1. Where BIA, SIA, and RA Fit in Your Framework These three risk-focused exercises act as a filter. They take your Business Inputs (1 Billion users) and ask: "What is the financial, operational, and technical impact if this system fails or slows down?"┌─────────────────────────────────────────┐
│       2. Business Input / Goals         │
│  (1B Users, 1 Post/Day, 10 Likes/Day)   │
└────────────────────┬────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────┐
│       BIA, SIA, & Risk Analysis         │ <── Calculates financial loss, user churn,
│  (How bad is a failure or 2-sec delay?) │     and system vulnerabilities.
└────────────────────┬────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────┐
│    3 & 4. Traffic Estimates & KPIs      │ <── Sets the maximum boundaries the
│ (10k/100k QPS, Throughput, p95 Latency) │     system must handle to avoid risk.
└─────────────────────────────────────────┘
Business Impact Analysis (BIA): Quantifies the financial and operational loss if the system degrades. For example: "If search latency exceeds 1 second, user engagement drops by 20%, costing the company $500,000 per day in lost ad revenue.

"Service Impact Analysis (SIA): Determines which microservices will break downstream. For example: "If the 'Like' database slows down under a 100k QPS spike, it will cascade and crash the Newsfeed service.

"Risk Analysis (RA): Identifies the vulnerabilities and threats to your capacity. For example: "There is a high risk of localized traffic spikes during major global events (e.g., the World Cup), which could double our peak traffic overnight."

2. How to Get the Traffic Estimates (Step 3)You derive the Traffic Estimates by combining your Business Inputs with your Risk Analysis (RA) safety factors. You never build a system exactly for the average traffic; you build it to survive the peak traffic calculated during Risk Analysis. The Formula: Calculate the Average Baseline:$$\frac{\text{1 Billion Posts}}{\text{100k seconds}} = 10,000 \text{ posts/sec (Average Load)}$$Apply the Risk Analysis Peak Factor: Your Risk Analysis tells you that traffic is never perfectly flat. Peak hours (like 8:00 PM) or breaking news events usually cause a $3\times$ to $5\times$ spike above the average baseline. The Final Traffic Estimate:$$10,000 \text{ Average QPS} \times 3 (\text{Risk Spike Factor}) = \mathbf{30,000 \text{ Peak Ingress QPS}}$$By using the math this way, your Traffic Estimate accounts for real-world risks, ensuring you provision enough servers to handle the maximum possible stress.

3. How to Get the Technical KPIs (Step 4)Your Technical KPIs are derived directly from the thresholds discovered during the BIA and SIA. The business impact tells you exactly what technical thresholds you need to measure to ensure the platform remains healthy. To get the specific KPIs, you map the BIA/SIA risks to automated technical metrics: Example 1: Deriving the Read KPI from BIA The BIA Finding: A delay over $1,000\text{ms}$ causes rapid user churn and loss of ad revenue. The Resulting Technical KPI: Search_Read_Latency_p99. You monitor the 99th percentile specifically because the BIA proved that letting even 1% of your users experience 1-second delays damages the business bottom line. Example 2: Deriving the Write KPI from SIAT he SIA Finding: If the database takes longer than $200\text{ms}$ to process a "Like" write request, the API Gateway's connection pool will saturate, causing a complete system outage. The Resulting Technical KPI: Like_Write_Throughput_Capacity and Database_Connection_Queue_Length.The Complete Enterprise Framework View When we inject BIA, SIA, and RA into your exact layout, the complete architectural picture locks into place: Framework Layer Description Example from Our System Driven/Informed By

1. Business KRA High-level strategic goal. User Growth & High Platform Engagement. Corporate Vision & Market Scan
2. Business Input Expected product metrics.1B users producing 1 post/day and 10 likes/day. Product Management & Growth Targets Analysis Intercept BIA, SIA, and Risk Analysis Assess the risk of 100k QPS load spikes and the financial impact of latency. Risk Assessment Frameworks
3. Traffic Estimate Back-of-the-envelope math + Risk safety factors.10k Average QPS (30k Peak QPS), 3.6 PB total storage. Business Inputs + Risk Spike Factors
4. Technical KPI Technical metrics monitored to prevent business impact. Write_Throughput_Capacity and Read_Response_Latency_p99.SIA Connection Limits & BIA Churn Thresholds
5. NFR Target The hard architectural constraint. Search results must render in $< 500\text{ms}$ at a peak of 30k QPS. Human Perception Limits & Revenue Protection

But what I have been trying to figure is Business Impact Analysis, Service Impact Analysis, and Risk Analysis apart of getting a KPI for a NFR? ->

1. Where BIA, SIA, and RA Fit in Your Framework These three risk-focused exercises act as a filter. They take your Business Inputs (1 Billion users) and ask: "What is the financial, operational, and technical impact if this system fails or slows down?"┌─────────────────────────────────────────┐
│       2. Business Input / Goals         │
│  (1B Users, 1 Post/Day, 10 Likes/Day)   │
└────────────────────┬────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────┐
│       BIA, SIA, & Risk Analysis         │ <── Calculates financial loss, user churn,
│  (How bad is a failure or 2-sec delay?) │     and system vulnerabilities.
└────────────────────┬────────────────────┘
                     │
                     ▼
┌─────────────────────────────────────────┐
│    3 & 4. Traffic Estimates & KPIs      │ <── Sets the maximum boundaries the
│ (10k/100k QPS, Throughput, p95 Latency) │     system must handle to avoid risk.
└─────────────────────────────────────────┘
Business Impact Analysis (BIA): Quantifies the financial and operational loss if the system degrades. For example: "If search latency exceeds 1 second, user engagement drops by 20%, costing the company $500,000 per day in lost ad revenue.

"Service Impact Analysis (SIA): Determines which microservices will break downstream. For example: "If the 'Like' database slows down under a 100k QPS spike, it will cascade and crash the Newsfeed service.

"Risk Analysis (RA): Identifies the vulnerabilities and threats to your capacity. For example: "There is a high risk of localized traffic spikes during major global events (e.g., the World Cup), which could double our peak traffic overnight."

2. How to Get the Traffic Estimates (Step 3)You derive the Traffic Estimates by combining your Business Inputs with your Risk Analysis (RA) safety factors. You never build a system exactly for the average traffic; you build it to survive the peak traffic calculated during Risk Analysis. The Formula: Calculate the Average Baseline:$$\frac{\text{1 Billion Posts}}{\text{100k seconds}} = 10,000 \text{ posts/sec (Average Load)}$$Apply the Risk Analysis Peak Factor: Your Risk Analysis tells you that traffic is never perfectly flat. Peak hours (like 8:00 PM) or breaking news events usually cause a $3\times$ to $5\times$ spike above the average baseline. The Final Traffic Estimate:$$10,000 \text{ Average QPS} \times 3 (\text{Risk Spike Factor}) = \mathbf{30,000 \text{ Peak Ingress QPS}}$$By using the math this way, your Traffic Estimate accounts for real-world risks, ensuring you provision enough servers to handle the maximum possible stress.

3. How to Get the Technical KPIs (Step 4)Your Technical KPIs are derived directly from the thresholds discovered during the BIA and SIA. The business impact tells you exactly what technical thresholds you need to measure to ensure the platform remains healthy. To get the specific KPIs, you map the BIA/SIA risks to automated technical metrics: Example 1: Deriving the Read KPI from BIA The BIA Finding: A delay over $1,000\text{ms}$ causes rapid user churn and loss of ad revenue. The Resulting Technical KPI: Search_Read_Latency_p99. You monitor the 99th percentile specifically because the BIA proved that letting even 1% of your users experience 1-second delays damages the business bottom line. Example 2: Deriving the Write KPI from SIAT he SIA Finding: If the database takes longer than $200\text{ms}$ to process a "Like" write request, the API Gateway's connection pool will saturate, causing a complete system outage. The Resulting Technical KPI: Like_Write_Throughput_Capacity and Database_Connection_Queue_Length.The Complete Enterprise Framework View When we inject BIA, SIA, and RA into your exact layout, the complete architectural picture locks into place: Framework Layer Description Example from Our System Driven/Informed By

1. Business KRA High-level strategic goal. User Growth & High Platform Engagement. Corporate Vision & Market Scan
2. Business Input Expected product metrics.1B users producing 1 post/day and 10 likes/day. Product Management & Growth Targets Analysis Intercept BIA, SIA, and Risk Analysis Assess the risk of 100k QPS load spikes and the financial impact of latency. Risk Assessment Frameworks
3. Traffic Estimate Back-of-the-envelope math + Risk safety factors.10k Average QPS (30k Peak QPS), 3.6 PB total storage. Business Inputs + Risk Spike Factors
4. Technical KPI Technical metrics monitored to prevent business impact. Write_Throughput_Capacity and Read_Response_Latency_p99.SIA Connection Limits & BIA Churn Thresholds
5. NFR Target The hard architectural constraint. Search results must render in $< 500\text{ms}$ at a peak of 30k QPS. Human Perception Limits & Revenue Protection

But I am sure I can deploy a web application once the AWS architecture is setup. Here it explains you can use Code Deploy and can use any backend framework like Laravel.

https://docs.aws.amazon.com/wellarchitected/latest/serverless-applications-lens/opex-deploying.html

This one is for Google well architected which I am sure you can deploy a Laravel backend framework.

https://docs.cloud.google.com/architecture/blueprints/security-foundations/deployment-methodology

There is this too for ECS

https://docs.aws.amazon.com/wellarchitected/latest/container-build-lens/prepare.html

So if I decide to follow the aws well-architected best practices and I can use the EC2 server that the aws well-architected step told me to setup then I will be able to deploy my Laravel/Nextjs to the EC2 server through SSH or through Github Actions?

Yeah I know that. But I was wondering if I wanted to deploy on AWS. Could I use the aws well-architected framework to deploy a web application using Laravel?

And if I use this also correct? -> https://aws.amazon.com/architecture/well-architected/ This will be the cloud architecture and virtual infrastructure?

Yes, you can develop a blog with laravel, you can basically create any kind of web application with it.

Start here https://laracasts.com/series/laravel-from-scratch-2026

If I choose one of these well-architecture frameworks

https://learn.microsoft.com/en-us/azure/well-architected/
https://aws.amazon.com/architecture/well-architected/
https://docs.cloud.google.com/architecture/fundamentals

Can I use them to create a web application like Blog, Social Network, CRM, and a web application of any type? And after the architecture implementation design from let's say the AWS Well Architecture framework, I start to code the entire web application using a something like Laravel/Nextjs/MySQL. Is this possible?

Okay thank you.

Yes, metrics like latency, throughput, error rates, and response times are absolutely web dev KPIs.

Your NFR might state: The API must have a response time of under 200ms under normal load.

Your KPI is the actual live metric you track in your APM to prove to management or clients that the app is performing as promised.

Are KPIs used for Non-Functional Requirements? And are KPIs like latency, throughput, and response times for the Performance NFR?

Are KPIs used for Accounts/Marketing and Sales/Manufacturing/etc...

So do KPIs have nothing to do with web development?

@martinbean That’s exactly the point. Even good engineers work on projects that fail. The difference is whether they recognized the risks, communicated them, and understood when the economics or technical direction stopped making sense.

@june92 For an MVP, you usually don’t need a full engineering organization. You need enough technical skill to validate the idea quickly and avoid painting yourself into a corner.

@digitalartisan so you are saying I just have to enough technical skill to understand why the web developer or web developers refactored the code. So if I had built an MVP and the new web developers working on the MVP said I refactored the validation logic you had for the Contact Controller to have a Form Request Validation. This is not a good example it is very simple and I know that validation logic should be in Form Requests. But what I am trying to say this is the "technical skill" I should have so that I can validate the code the web developer just reviewed with me. There will be way more advanced code the web developer will review with me but that is the "technical skill" you are referring to correct? Or what do you mean "enough technical skill to validate the idea"?

If I were to build a successful MVP, would I need engineers? I would only want the code refactored until I would actually need others like DevOps, QA, UX, and Frontend Web Developers, etc...

Has any Laravel Developer here tried to use UX case studies and User Research & Personas to find "real frustration" for a Problem Statement? And if so, do some web developers do this and if they are trying to find "real frustration" for a REI CRM, for example, and then they find no paint points from User Research and interviews either on Reddit or other platforms, then would it be okay to just move on to another SaaS Product or other web applications until "real frustration" has been found for a web application?

If the code is bad, I would make it maintainable.

Okay thanks.

You are creating it? How? What is the stack? What development tools are you using? What is the test case coverage? Is this 100% AI generated?

would web devs not work on it if it was not successful?

Correct, I would not work on it. What is the point if it is not successful.

the CRM did not have good code even though it works and follows best practices? 

Bad architecture can follow best practices and have bad code. Through away prototypes, major refactoring, legacy old project, and or starting from scratch is what I read.

Do you mean use it or fix it for you?

If it's working code just needing some refactoring, why wouldn't they.

No what I mean is I know my code won't be that bad and if I put effort into it and build a REI CRM then if I start to hire web developers to join my team, my question is will a web developer see my REI CRM code and say this does not seem like good code I think I will pass. Or will some web developers I think the word is "refactor" and like if they think for example, "You failed to add a http status code like 200" or "You did not add a API resource", or "You have used way to many if statements and can be easier maintained like this:

if('votes' == 100){
}

if('age' > 35){
}
etc...

and the web developer says this can be done easily with Eloquent ORM like this

$user->posts()->where('votes', '=', 100)->where('age', '>' , 35)->get();

or the web developer wants to add something I have never hear of before (which would be a good thing) like "middleware", which I do know what it is but it's just an example.

So would a web developer try to refactor this and modify it since the REI CRM has already active users and is generating some revenue? Or will the dev just look at the code and say "I'll pass".

And no I don't mean hiring a web developer to use the REI CRM. I mean if he can work with me to improve the REI CRM, or even if I can get team of 2-3 they can improve the REI CRM, not me.

Okay

So if the code is bad, then you would not work on it?

Like improve the code.

So web developers will do this, is this apart of web development?

I want to create a Real Estate Investment CRM. I just wonder if I created a REI CRM and it started getting a good amount of users and the users are using the CRM but needed to be maintained. Will web developers not work on this because the codebase was not what they expected and think the CRM did not have good code even though it works and follows best practices? Even if the CRM was generating some revenue. Or will the web developers see that the CRM needs work and improve it.