Security
305 bites tagged Security — interview questions with model answers, and 60-second explainers.
How would you integrate SAST into CI without alert fatigue?
This tests embedding security into workflow without killing velocity. Run SAST per commit, suppress false positives via rulesets, gate on high-severity findings first and block merges only after calibration. A red flag is zero-tolerance blocking on day one.
How do you fully remove leaked credentials from Git history?
This tests Git history rewriting and incident response. Rotate the secret first, then use git-filter-repo to purge the file, force-push main, and require all teammates to re-clone before resuming. A red flag is recommending git revert or skipping rotation.
Security Champions: Embedded Team Defense
A security champions program embeds trained developers inside teams to catch risks early. It scales AppSec without hiring a specialist for every squad. The footgun is treating champions as free labor instead of investing in their training and time.
Dynamic Secrets: Temporary On-Demand Credentials
Dynamic secrets are temporary credentials minted on demand, not static passwords living in config files. A CI job requests a 15-minute database lease instead of a long-lived env var.
Vault: Centralized Secrets with Dynamic Leasing
Vault is a secrets firewall: it centralizes credentials and issues short-lived leases instead of static keys. Use it when apps need DB passwords not hardcoded. The footgun is using Vault without audit logs, leaving secrets unmonitored.
Google Play App Signing: upload key versus app signing key
Tests Android signing infrastructure and key escrow knowledge. A strong answer states Google holds the app signing key while you retain an upload key, protecting critical signing material. Red flag: claiming both keys sign the final install artifact.
Purpose of Android app signing and keystore contents
Signing proves authorship and integrity, enables same-key updates, and binds app identity; a keystore holds private keys and certificates. App identity on Android.
Use Android Keystore to secure a database encryption key
Tests Android Keystore key generation and hardware trust boundaries. Strong answers: KeyGenParameterSpec with AES/GCM, TEE vs StrongBox isolation, setIsStrongBoxBacked on API 28+ with fallback, wrapping the database key. Red flag: claims Keystore encrypts DBs.
What is certificate pinning and what are its trade-offs?
Pinning hardcodes a server key to block rogue CA MITM; trade-offs are breakage on cert rotation and forced updates. Understanding TLS trust chain attacks beyond HTTPS.
Why avoid plain SharedPreferences for secrets and what to use?
Tests data-at-rest security awareness. A strong answer notes plain SharedPreferences writes unencrypted XML that rooted users or backups expose, then names EncryptedSharedPreferences with Android Keystore.
How do you manage API keys across Gradle build variants securely?
Gitignore a properties file, load it in build.gradle, map secrets to BuildConfig or manifest placeholders by flavor, and commit safe defaults. Gradle secret injection per build variant without committing credentials.
Managing Sensitive Information in Gradle Builds
Tests secure credential handling in Android builds. A good answer uses a git-ignored `.properties` file, the `secrets-gradle-plugin` to parse it, and accesses keys via `BuildConfig`. A red flag is storing keys directly in `build.gradle` or committing them.
How would you manage API keys in Gradle without version control?
Tests secure credential handling in Android builds. A good answer proposes the Secrets Gradle Plugin, which reads from an untracked properties file and exposes keys via BuildConfig, while also noting this doesn't protect against APK decompilation.
ContentProvider: Android's Shared Data API
A ContentProvider is a structured API gateway for your app's private data. It lets other apps query, insert, or delete data securely without direct access. The main footgun is improper permission handling, which can leak data or cause crashes.
Design a Privacy-Compliant Analytics Architecture
This tests your ability to balance data utility with strict privacy controls. A great answer outlines a central governance layer, dynamic masking, and purpose-based access tied to auditable logs.
SvelteKit Server-Only Modules: Keep Your Secrets Secret
SvelteKit's server-only modules are a firewall for your code, preventing sensitive data like API keys from ever being bundled for the browser. Use them for database clients or secret logic.
Securing Research Data with a Management System
Treat data security as a living system for managing risk, not a one-off checklist. A framework like ISO 27001 helps you systematically protect sensitive research data by defining policies and controls.
Password Hashing and Salting: Store Credentials Securely
Never store plaintext passwords. Instead, use a slow, one-way hash combined with a unique salt for each user, making it computationally expensive to reverse. This is essential for any app with user logins.
HttpOnly Cookies: Keep Secrets from JavaScript
The HttpOnly flag makes cookies inaccessible to client-side JavaScript, preventing theft via XSS attacks. Use it for session tokens the server needs but the UI doesn't.
Auth.js: Full-Stack Authentication for Next.js
Auth.js simplifies full-stack authentication in Next.js, handling social logins and session management. It lets you add providers like GitHub with minimal code, abstracting away OAuth flows.
OAuth 2.0: Delegated Access, Not Shared Passwords
OAuth 2.0 lets users grant limited access to their data without sharing passwords. It's used when a third-party app needs to read your Google Calendar. The common footgun is mistaking it for authentication (logging in); it's for authorization.
Next.js Environment Variables: Server vs. Browser
Next.js environment variables separate server secrets from public browser config. Use them for API keys or database strings. The key footgun is exposing secrets by forgetting to prefix browser-accessible variables with `NEXT_PUBLIC_`.
JSON Web Tokens (JWTs): Stateless API Passports
A JWT is a digitally signed passport for your web session, letting a server verify your identity without a database lookup on every request. It's used for stateless API authentication. The footgun: its payload is readable, so never store secrets there.
Configuring Security Headers in Next.js
Security headers are rules your server sends the browser to prevent attacks like XSS and clickjacking. In Next.js, you configure these globally in `next.config.js`.
Get Security bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.