Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
How do you create a reusable current-user dependency in FastAPI?
Tests DRY auth with FastAPI Depends. Answer: create get_current_user that Depends on OAuth2PasswordBearer, verifies token, returns User model, inject into routes. Red flag: middleware or manual header parsing in each endpoint.
How do you prevent password_hash from appearing in a FastAPI response?
Tests FastAPI response filtering and the security practice of separating DB schemas from API contracts. A strong answer proposes a dedicated output model omitting the field, then cites response_model_exclude. Red flag: manual dict deletion or monkey-patching.
JWT: Signed JSON Claim Tokens
A JWT is a signed JSON envelope: it carries claim assertions in JSON, optionally encrypted, and proves who wrote it using either a private secret or a public/private key. Do not treat the payload as hidden unless encryption is actually enabled.
Compare webhooks to sandboxed plugins for monolith extensibility
Tests distributed vs in-process extensibility. Webhooks are async, loosely coupled, and isolated but add network latency. Sandboxed plugins run in-process for low-latency UI depth yet need strict host API permissions and lifecycle gating.
express-validator: Validate at the Edge
express-validator stops garbage before it hits your logic. Use it on any route that accepts user input like form data, query strings, or JSON payloads. The biggest mistake is validating but forgetting to check validationResult, so invalid requests pass.
Validation Checks Rules; Sanitization Cleans Input
Validation checks if input fits your rules and rejects failures. Sanitization cleans allowed input so it cannot cause harm. Validate at the boundary to enforce shape, then sanitize before rendering. Never swap them; scrubbing a bad date does not make it valid.
Bcrypt: Hash Passwords with Salt and Slowness
Bcrypt salts and slows every password hash so identical passwords never look the same and brute force stays expensive. Use it in register and login routes before the database. Never compare hashes with plain string equality; always call bcrypt.compare().
JWT Authentication: Signed Claims, Not Sessions
A JWT is a signed JSON blob that lets a server trust a client without storing session state. Express APIs use it to stay stateless across load-balanced servers. The footgun is stuffing secrets inside because the payload is only Base64, not encrypted.
Design an ML workflow that masks PII from scientists
This tests privacy-preserving pipeline design and least-privilege access for ML teams. Propose automated de-identification before experimentation, restrict re-identification to production jobs, and enforce role-based access with audit logs.
Design a defense-in-depth strategy against adversarial evasion on a deployed image classifier
Proactive: adversarial training, preprocessing, ensembles. Your ability to layer training-time and inference-time defenses for adversarial robustness.
Design a cryptographically verifiable ML audit trail from dataset to deployment
Tests cryptographic provenance and tamper-evident ML pipelines. Strong answers cover content-addressed datasets, signed training logs linking code and hyperparameters to model hashes, and deployment signature checks.
What is the wrong and right way to manage ML database secrets?
This tests secret management hygiene for ML pipelines. A strong answer rejects hardcoded secrets and env vars, then proposes AWS Secrets Manager with IAM retrieval, TLS, caching, and rotation. A red flag is suggesting .env files, ConfigMaps, or CLI arguments.
Describe securing an automated ML pipeline and CI/CD integration points
Tests ML supply-chain depth versus bolt-on appsec. Strong answers stage checks across dependency scans at build, container and model scans before registry, plus runtime input guards.
Data Poisoning: Corrupting Models at the Source
Data poisoning is slipping lies into a textbook that a model memorizes forever. It shows up when you train on scraped web data or open fine-tuning sets. The footgun is assuming clean benchmarks mean clean weights; poison can hide until a trigger appears.
Walk me through a magic link login system and its security considerations
Tests auth architecture and threat modeling for passwordless flows. Strong answers map request-token-email-verify-session, then harden with short expiry, single-use tokens, rate limits, and device binding.
How would you implement a timezone-safe, tamper-proof offer countdown?
Tests distrust of the client and server-side UTC enforcement. Outline: server owns canonical end time; client syncs clock offset to render remaining time; checkout re-validates expiry. Red flag: using local Date.now or localStorage.
Explain fuzz testing and set up a basic fuzz test
This tests coverage-guided fuzzing and toolchain wiring. Strong answer: defines fuzzing as automated input mutation driven by code coverage, contrasts it with hand-written examples, and sketches Go's FuzzXxx or Rust's cargo-fuzz setup.
Securely inject secrets for build flavors in CI/CD
Contrast CI environment variable injection with runtime secrets-manager fetches via CLI, comparing rotation overhead and blast radius. Secret management and threat modeling for CI/CD build flavors.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
Implement OAuth 2.0 flow to get an access token for API requests
Tests your grasp of OAuth 2.0 grant-type selection and token lifecycle. Strong answers match the script context to client credentials or authorization code flow, detail the token endpoint exchange, and address refresh and expiry.
What client-side and server-side validations belong on a campaign sign-up form?
This tests defense in depth and UX trade-offs. A strong answer maps validations to layers: regex and immediate feedback client-side, strict schema and rate limiting server-side, plus duplicate checks. Red flag: claiming client-side validation is sufficient.
How to structure translation keys for dynamic localized strings
Tests ICU MessageFormat and safe interpolation. Outline: one key per sentence with named placeholders; sanitize variables pre-format; use pattern-level plural and select. Red flag: concatenating fragments or injecting raw user input into templates.
Justify static site generator vs CMS for a portfolio site
Matching tool complexity to static publishing needs. Choose Hugo or Jekyll with Git and a CDN; removing runtime databases eliminates per-request latency and PHP exploit surfaces.
Design a simple templating system for ad copy generation
Tests separation of concerns and API design. A good answer: data model separate from template, placeholder syntax, graceful missing-value handling, and HTML escaping. Red flag: naive string concatenation without validation or extensibility.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.