Security
312 bites tagged Security: interview questions with model answers, and 60-second explainers.
Test yourself: Top 30 Security interview questions →Multiple choice, with the correct answer and why it is correct on every question. Free, no sign-in.Next.js fixes September 2026 image and cache vulnerabilities
Next.js 16.3.8 and 15.5.27 fix a critical and a high-severity issue. Check whether Image Optimization uses remotePatterns, whether a self-hosted Pages Router uses SSG or ISR, and whether catch-all or cache-preview features are enabled before patching and retesting.
Next.js revises its September security release to seven vulnerabilities
Next.js revised its September security notice to seven vulnerabilities. Two more issues remain pending upstream coordination; verify the current advisory before upgrading.
Docker publishes Sandbox Kit Specification v3
Docker published an open-source Kit Specification v3 for packaging an agent’s runtime, tools, permissions, and network policy with its environment.
GitHub describes an agentic fuzzing taskflow
GitHub Security Lab describes a taskflow that finds entry points, writes harnesses, runs AFL++, and triages crashes for C/C++ projects.
Next.js publishes a security update for an upstream issue
Next.js advised patching to 16.3.6 or 15.5.26 on 22 September; the update addresses an upstream Satori issue affecting some ImageResponse usage.
GitLab publishes critical patch releases 19.4.1, 19.3.3 and 19.2.7
GitLab released 19.4.1, 19.3.3 and 19.2.7 on 23 September with important bug and security fixes for self-managed installations.
Critical vm2 sandbox escape (CVSS 10.0) traced to its own README example
GitLab's Threat Research Group found a CVSS 3.1: 10.0 sandbox escape in vm2, a widely used Node.js sandbox library, in a config copied from vm2's own README. Version 3.11.7 fixes the attack, but the underlying risk remains for anyone using require.external. Update immediately and prefer containers for untrusted code.
Multi-stage Docker builds for lean production images?
Build stage compiles/installs, runtime stage copies artifacts only, discards build tools.
Environment configuration and secrets management in Node.js?
Use environment variables, load from .env file (dev only), never commit secrets.
How to authenticate WebSocket connections using JWTs?
Client sends JWT on connection, server validates via middleware, socket is attached to user.
What is PII and how to keep it out of logs
Define PII, redact or mask at the logging boundary, and avoid logging sensitive fields at the source.
localStorage vs httpOnly cookie for auth tokens
LocalStorage is JS-readable so XSS steals it; httpOnly cookies are JS-invisible blocking XSS theft but exposed to CSRF, mitigated by SameSite and tokens.
Secure refresh token flow for access renewal
Short-lived access token, longer-lived refresh token stored server-side, a refresh endpoint that validates and rotates the refresh token issuing a new pair.
Revoking stateless JWTs on logout
A server-side denylist of revoked token IDs checked per request, or short-lived access tokens paired with revocable refresh tokens.
Strict tenant isolation in a multi-tenant data layer
Choose silo, pool, or bridge by risk; enforce tenant scoping at multiple layers with RLS; encrypt and audit.
JWT login and protected route flow in Express
Verify credentials, sign a JWT, client stores and sends it (Authorization header or httpOnly cookie), middleware verifies signature on protected routes.
Managing secrets for containerized Node.js on Kubernetes
Use Kubernetes Secrets or an external vault, mount as files not env, encrypt at rest, rotate.
JWT storage: localStorage versus HttpOnly cookie
LocalStorage is JS-readable so XSS steals the token; HttpOnly cookies resist XSS theft but reintroduce CSRF, mitigated by SameSite plus CSRF tokens.
Prototype pollution: how it works and prevention
Attacker writes to Object.prototype via __proto__ keys in merge/parse code, poisoning all objects; prevent by guarding keys, null-prototype objects, Object.freeze, Map, and patched deps.
Deploying a strict CSP for an Express SPA
Define directives, start in Report-Only to gather violations, then enforce; allow inline code via per-request nonces or hashes plus strict-dynamic instead of unsafe-inline.
Auditing and fixing vulnerable npm dependencies
Run npm audit (or yarn audit) to list advisories, npm audit fix to patch within semver, bump majors deliberately, and lock versions; wire audits into CI.
Input validation versus output encoding
Validation checks input fits expected rules on entry; encoding makes data safe for a specific output context on exit. You need both; encoding is the real anti-XSS control.
Preventing SQL injection with parameterized queries
The flaw is SQL injection; prevent it with parameterized queries/prepared statements (pg $1, mysql2 ?), never string concatenation, so input is data not code.
Explaining and preventing CSRF in Express
CSRF abuses a victim's ambient cookies to forge state-changing requests; the server issues an unpredictable token tied to the session, embeds it in forms, and validates it…
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.