A research library for responsible product development

This is a living reference library for the choices that shape digital products. It brings together standards, peer-reviewed research, foundational papers, and books we return to when scoping websites, applications, integrations, and automation. The links are starting points for study, not claims that every source applies to every project. Prefer the current edition of a standard, check publication context, and validate findings against the actual users and constraints of a project.

How this research guides our app development

Begin with people, tasks, and evidence

We start by understanding who is trying to do what, in which context, and what currently makes the task hard. Interviews and observation help surface the real workflow; usability studies show where people struggle; product discovery tests whether a proposed solution addresses a consequential need. A feature request is evidence about a problem, not yet a complete design specification. We make assumptions visible, choose a small testable slice, and define a user outcome before implementation.

Make the interface accessible by default

Accessibility is part of the interaction model and quality bar, not a final visual polish pass. We use semantic HTML, keyboard operability, visible focus, meaningful labels, understandable errors, sufficient contrast, and responsive layouts. Automated checks can catch some failures, while keyboard and assistive technology review expose others. The relevant target and conformance obligations depend on the product and jurisdiction and should be agreed explicitly.

Treat security and privacy as design constraints

We minimize collected data, access, retention, and third-party exposure. Threat modeling and secure development practices belong in planning, implementation, review, deployment, and maintenance. Authentication does not replace authorization; input validation does not replace output encoding; encryption does not make unnecessary data collection safe. Risk decisions need an owner, an explicit rationale, and a recovery plan.

Prefer understandable, observable systems

Maintainability is a product concern: future changes, incident diagnosis, and handoff all depend on clear boundaries and useful documentation. We favor the least complex design that meets measured needs, automate repeatable checks, and instrument outcomes without collecting more personal data than necessary. Reliability requires graceful failure, backups where appropriate, accessible recovery paths, and a named operational owner.

Use AI with a bounded role

AI features need a clearly defined job, representative evaluation examples, human recourse, data-handling review, and monitoring for quality and harm. A language model can produce plausible errors; confidence in prose is not evidence of correctness. We compare an AI approach with simpler rules or workflow changes, and keep a human decision maker for consequential actions unless the use has been specifically validated and governed.

Learn after release

Release is the beginning of operational learning. We review usability findings, failures, support requests, performance, and the agreed outcome measure. We document what changed and why, revisit decisions when context changes, and keep a path to correct or reverse changes. Research does not remove judgment; it makes assumptions and trade-offs easier to inspect.

Standards, guidance, and technical references

Accessibility and inclusive design

1. W3C Web Content Accessibility Guidelines (WCAG) 2.2
2. W3C Web Accessibility Initiative (WAI)
3. WAI-ARIA 1.2
4. ARIA Authoring Practices Guide
5. WebAIM: Introduction to Web Accessibility
6. MDN: Accessibility
7. Inclusive Components
8. Microsoft Inclusive Design
9. W3C: Easy Checks for Web Accessibility
10. W3C: Understanding WCAG

Security, privacy, and reliability

11. OWASP Application Security Verification Standard
12. OWASP Top 10
13. OWASP Cheat Sheet Series
14. OWASP Web Security Testing Guide
15. NIST Secure Software Development Framework (SSDF)
16. NIST Privacy Framework
17. NIST Cybersecurity Framework
18. CISA Secure by Design
19. Mozilla Observatory
20. Cloudflare Learning Center: Web security
21. Google Web Fundamentals: Security
22. IETF RFC 9110: HTTP Semantics
23. IETF RFC 8446: TLS 1.3
24. IETF RFC 9457: Problem Details for HTTP APIs
25. OWASP API Security Top 10

Web platform, performance, and engineering practice

26. MDN Web Docs
27. WHATWG HTML Living Standard
28. ECMAScript Language Specification
29. W3C Web Performance Working Group
30. Core Web Vitals
31. web.dev Learn
32. Google Search Central: SEO Starter Guide
33. The Twelve-Factor App
34. Google Site Reliability Engineering
35. Google SRE Workbook
36. Martin Fowler: Continuous Integration
37. Martin Fowler: Refactoring
38. DORA research
39. CNCF Cloud Native Trail Map
40. OpenTelemetry documentation

Papers and research we find useful

Human-computer interaction and usability

41. Nielsen, “Enhancing the explanatory power of usability heuristics” (1994)
42. Brooke, “SUS: A quick and dirty usability scale” (1996)
43. Lewis, “IBM Computer Usability Satisfaction Questionnaires” (1995)
44. Lazar, Feng & Hochheiser, Research Methods in Human-Computer Interaction
45. Wobbrock & Kientz, “Research contributions in human-computer interaction” (2016)
46. Nielsen, “Why You Only Need to Test with 5 Users”
47. Sauro & Lewis, “When Designing Usability Questionnaires, Does It Hurt to Be Positive?”
48. Card, Moran & Newell, The Psychology of Human-Computer Interaction
49. Norman, “The Design of Everyday Things” resources
50. W3C: Research on web accessibility

Software quality, architecture, and delivery

51. Brooks, “No Silver Bullet” (1987)
52. Boehm, “A Spiral Model of Software Development and Enhancement” (1988)
53. Fagan, “Design and Code Inspections to Reduce Errors in Program Development” (1976)
54. Humphrey, “The Personal Software Process” (1995)
55. Forsgren, Humble & Kim, “The SPACE of Developer Productivity” (2021)
56. Meyer et al., “A controlled experiment in continuous integration” (2014)
57. Kim et al., “Understanding the Impact of Technical Debt on Software Quality”
58. Beyer et al., “Site Reliability Engineering”
59. Allspaw & Robbins, Web Operations
60. Bass, Clements & Kazman, Software Architecture in Practice

Product discovery, teams, and workflow design

61. Ries, “The Lean Startup”
62. Gothelf & Seiden, “Lean UX”
63. Cagan, “Inspired”
64. Patton, “User Story Mapping”
65. Sutherland, “The Scrum Guide”
66. Womack & Jones, “Lean Thinking”
67. Larman & Basili, “Iterative and Incremental Development: A Brief History”
68. Edmondson, “Psychological Safety and Learning Behavior in Work Teams” (1999)
69. Forsgren, Humble & Kim, “Accelerate”
70. DORA: The four keys

AI, data, and automation

71. NIST AI Risk Management Framework
72. OECD AI Principles
73. Amershi et al., “Guidelines for Human-AI Interaction” (2019)
74. Sculley et al., “Hidden Technical Debt in Machine Learning Systems” (2015)
75. Mitchell et al., “Model Cards for Model Reporting” (2019)
76. Gebru et al., “Datasheets for Datasets” (2021)
77. Raji et al., “Closing the AI Accountability Gap” (2020)
78. Bommasani et al., “On the Opportunities and Risks of Foundation Models” (2021)
79. Bender et al., “On the Dangers of Stochastic Parrots” (2021)
80. Ribeiro et al., “Why Should I Trust You?” (2016)
81. NIST Privacy Engineering Program
82. W3C Data Privacy Vocabulary
83. ACM Code of Ethics
84. Partnership on AI: Responsible Practices
85. Google People + AI Guidebook

Books for deeper study

86. Don Norman, The Design of Everyday Things
87. Steve Krug, Don't Make Me Think
88. Erika Hall, Just Enough Research
89. Teresa Torres, Continuous Discovery Habits
90. Mike Monteiro, Ruined by Design
91. Alan Cooper et al., About Face
92. Jesse James Garrett, The Elements of User Experience
93. Steve Portigal, Interviewing Users
94. Jeff Gothelf & Josh Seiden, Lean UX
95. Marty Cagan, Inspired
96. Melissa Perri, Escaping the Build Trap
97. Matthew Skelton & Manuel Pais, Team Topologies
98. Gene Kim, Kevin Behr & George Spafford, The Phoenix Project
99. Nicole Forsgren, Jez Humble & Gene Kim, Accelerate
100. Robert C. Martin, Clean Architecture
101. Martin Fowler, Refactoring
102. Kathy Sierra, Badass: Making Users Awesome
103. Ethan Marcotte, Responsive Web Design
104. Heydon Pickering, Inclusive Components
105. Adele Goldberg & Alan Kay, Smalltalk-80: The Language and Its Implementation

Using this library

Start with the standard or research area closest to the decision at hand. Read the primary source where possible, note the population and context studied, and record what the source does and does not support. For a project decision, pair desk research with user feedback, technical constraints, and a small validation step. This library is curated rather than exhaustive and will be reviewed as standards and evidence evolve.