Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
Authentication versus authorization in Express
Authentication proves who you are, authorization decides what you may do, authentication happens first. a core security vocabulary distinction.
Mongoose pre('save') hooks for password hashing
Pre('save') runs before persistence; use it to hash the password, guarding with isModified, calling next() or returning. lifecycle hooks on documents.
Write a JWT authentication middleware
Read the header, strip Bearer, jwt.verify with the secret, set req.user and next(), else send 401. extracting a Bearer token, verifying it, and gating access. calling next() after sending 401, or trusting an unverified token.
Client-side vs server-side feature flags
Client-side is fast and offline-capable but exposes flag logic and risks stale or leaked values; server-side keeps logic secret and consistent but adds latency. Flag evaluation placement.
Automate temporary elevated database access securely
Self-service request with approval, short-lived auto-expiring grants scoped to least privilege, and full audit logging. Just-in-time access design.
Epsilon in differential privacy and its trade-offs
Epsilon is the privacy budget bounding how much one record can change outputs; smaller epsilon means stronger privacy but more noise and lower accuracy. privacy-utility-cost balance.
Direct versus indirect injection and agent defenses
Direct injection comes from the user prompt; indirect hides in third-party data the agent ingests like web pages. agent security under injection.
Prompt injection versus jailbreak, and defenses
Injection hijacks the model via untrusted data overriding developer instructions; jailbreak coaxes a model past its safety policy. Defense: separate trusted instructions from untrusted data and filter. precise security distinctions.
Red teaming LLMs and harmful output categories
Red teaming deliberately probes a model to elicit harmful behavior; categories include toxic or hateful content and dangerous instructions like weapons or malware. understanding adversarial safety testing.
Write a frontend-to-backend NetworkPolicy
Set podSelector to app=backend, policyTypes Ingress, one ingress rule with from podSelector app=frontend and ports TCP 8080; the implicit deny handles the rest. Authoring a correct ingress NetworkPolicy.
Troubleshooting an RBAC forbidden error
Use kubectl auth can-i with --as impersonation to check the verb, inspect RoleBindings and ClusterRoleBindings, and read the role rules. Practical RBAC debugging.
First NetworkPolicy flips a pod to default-deny
Once any policy selects a pod for a direction, that direction becomes default-deny and only explicitly allowed traffic passes; unselected pods stay open. NetworkPolicy default behavior.
Role versus ClusterRole in RBAC
Role is namespaced, ClusterRole is cluster-wide and covers cluster-scoped resources, and you grant either via a RoleBinding (namespaced) or ClusterRoleBinding (cluster-wide) to a subject. RBAC scope basics.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit. understanding that encoding is not encryption.
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell. minimal base image strategy.
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time. secure build secret handling.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs. container security hardening.
Multi-stage builds for compiled languages
Build in a stage with the full toolchain, then COPY --from only the artifact into a tiny final base, shrinking image size and attack surface. image slimming and build hygiene.
Defense-in-depth against SQL injection
Beyond parameterization, apply least-privilege accounts, stored procedures, input allowlisting, and monitoring to shrink blast radius. layered SQLi mitigation. treating parameterized queries as the only and complete defense.
RBAC vs direct user grants
Direct grants tie rights to individuals; RBAC groups rights into roles users inherit, so changes happen once per role. permission-management scalability.
Least privilege for database service accounts
Grant each account only the minimum rights its job needs; for an app service account, scope grants to specific tables and verbs, never use the superuser. secure access design.
Balance agility and compliance in regulated cloud
PaaS for speed where allowed, IaaS where control is required, enforced by encryption, IAM least privilege, network isolation, policy-as-code guardrails, and continuous audit logging. compliance-aware architecture.
Design an enterprise cloud landing zone
Multi-account or subscription structure, centralized identity and SSO, network topology like hub-and-spoke, guardrails via policy and SCPs, and centralized logging. cloud foundation and governance design.
Enforce a cloud resource compliance policy
Prevent at creation with org policies or admission checks, detect violations via continuous config scanning, and auto-remediate by stripping the IP or alerting owners. policy-as-code guardrails. manual periodic audits only.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.