Security
Security questions at lead level are rarely trivia. They are judgment questions wearing trivia clothes: which vulnerability class actually gets exploited, how you prioritise patching when everything is critical, how you sequence a multi-year zero-trust program, and how you keep a stolen bearer token from being usable.
Two answers reliably separate staff from senior here. First, prioritising patching by CISA KEV and EPSS with exposure context rather than CVSS alone. Second, offering a STRIDE threat model for a design unprompted, which almost no candidate does.
What this chapter covers
- [done] PKCE and the authorization code flow
- [todo] The OAuth grants that are alive, and the two that are dead
- [todo] Access, refresh and ID tokens, and what each is not for
- [done] Revoking stateless JWTs
- [todo] JWT validation implemented, with every check justified
- [todo] Refresh token rotation with reuse detection
- [todo] DPoP and mTLS-bound tokens
- [todo] Token exchange for on-behalf-of chains
- [todo] The OAuth vulnerability catalog: redirect wildcards, mix-up, alg confusion
- [todo] RBAC to ABAC to ReBAC, with Zanzibar tuples explained
- [done] Zero trust, and the sequencing
- [todo] Workload identity: SPIFFE/SPIRE, IRSA, no static credentials
- [todo] SSRF and cloud metadata, exploitation and defence
- [todo] A STRIDE threat model worked on a real system
- [todo] Supply chain: SBOM, SLSA, sigstore, dependency confusion
- [todo] Secrets: dynamic credentials, rotation, scanning history
- [todo] The security pipeline: SAST, SCA, DAST, IaC, container, admission control
- [done] CVSS, EPSS and KEV
- [todo] The zero-day response runbook, narrated
- [todo] Compliance as engineering constraints
Source: §21.