Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Open Policy Agent (OPA): Centralized Policy as Code
OPA decouples policy decisions from your app's code. Instead of scattering `if` statements, you query a central engine: 'Is this allowed?' It enforces rules in Kubernetes, CI/CD, and API gateways. A common footgun is only using it for yes/no decisions.
Secrets Management in CI/CD Pipelines
Treat secrets like temporary keys, not permanent passwords. Your CI/CD pipeline should fetch them just-in-time from a central vault, never storing them in code. The biggest footgun is storing secrets as long-lived environment variables in the CI tool itself.
Artifact Vulnerability Scanning: A Background Check for Code
Artifact vulnerability scanning is a background check for your software's dependencies, catching known security issues before they ship. It's a key CI/CD step, automatically scanning Docker images against databases of known CVEs. The footgun is alert fatigue.
Software Bill of Materials (SBOM): An Ingredient List for Your Code
An SBOM is a nutrition label for your code, listing every library and dependency. It's crucial for security audits and managing supply chain risk, letting you instantly find systems affected by a new vulnerability.
Transitive Dependencies: The Hidden Baggage in Your Code
Think of transitive dependencies as your dependency's dependencies. You add one library, but it pulls in others you didn't explicitly ask for. This happens in any project using a package manager.
DAST: Probing a Running App for Security Flaws
DAST acts like an automated pen-tester, attacking your running application from the outside to find flaws without seeing the code. It's used in CI/CD to catch common web vulnerabilities. The footgun: DAST can't see the code, so it misses business logic errors.
Reproducible Builds: Trust What You Run
A reproducible build guarantees that the same source code always compiles into the exact same binary. This is crucial for verifying that a distributed application wasn't tampered with.
APK Signature Scheme: Verifying App Integrity
An APK signature is a tamper-evident seal, proving an app is from a specific developer and hasn't been altered. Android uses it to trust app updates and prevent malware. The footgun: losing your signing key means you can never update your app again.
Android Network Security Configuration
Define your app's network trust rules in a simple XML file instead of writing complex code. Use it to block cleartext (HTTP) traffic, trust self-signed certs in debug builds, or pin certificates.
App Signing by Google Play: Trust Google with Your Keys
App Signing by Google Play separates your app's identity from the key you use for uploads. Google manages the final, user-facing signing key, which is mandatory for new apps. The footgun is thinking your upload key is the final key; losing it is recoverable.
Android Biometric Authentication: The BiometricPrompt API
Android's BiometricPrompt is a unified API for fingerprint, face, or iris scans, replacing older, fragmented methods. Use it to authorize payments or unlock features. The footgun: never assume a specific biometric type is available; always have a fallback.
EncryptedSharedPreferences: Secure Key-Value Storage on Android
EncryptedSharedPreferences is a drop-in replacement for SharedPreferences that automatically encrypts keys and values, protecting sensitive data at rest. Use it to store small, sensitive data like API tokens. The main footgun is mismanaging the master key.
Android Keystore System
The Android Keystore System stores cryptographic keys in hardware backed secure storage instead of app memory or disk. Apps can use the keys to sign or encrypt data, but the raw key material never leaves the secure environment, even on a rooted device.
Certificate Pinning: Trusting Only Your Own Servers
Certificate pinning hardcodes your server's public key hash into your app, rejecting any other certificate. This prevents man-in-the-middle attacks from compromised CAs. The footgun: if the server certificate changes, your app breaks until you update the pin.
FileProvider: Securely Share Files Between Apps
FileProvider is Android's bouncer for files, replacing insecure `file:///` URIs with temporary, permission-granted `content://` URIs. Use it to send a photo for editing or attach a PDF to an email.
Data Validation: Garbage In, Garbage Out
Data validation is the bouncer for your app, checking data at the door to ensure it's correct and useful. It's used on user forms, API requests, and file imports. The footgun is skipping it, which risks corrupted data, security holes, and future crashes.
Explain prompt injection and how to defend against it
This question tests your understanding of LLM security vulnerabilities and how untrusted user input can manipulate model behavior. A strong answer defines prompt injection as hijacking the model's instructions, then outlines a layered defense including input sanitization, instruction-tuned models, and separating user input from system prompts. A common red flag is confusing it with traditional SQL injection or suggesting simple input filtering is a sufficient solution.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.