Coverage by interview path
- All paths — Topics 1 (Foundations), 7 (Secure SDLC)
- Backend — Topics 2 (Auth), 4 (API security)
- Fullstack — Topics 2–3 (Auth + Web/browser security)
- Distributed / platform — Topics 2, 4–5 (Auth, API, platform trust)
- Data engineer — Topics 6 (Privacy & PII) + Topic 4 API exposure
- Topic 8 (Deep Cuts) — LLM security bridge, crypto right answers, compliance awareness (optional).
The Reference
- 1
How senior software engineers think about security — without becoming a security specialist.
- 2
OAuth2, OIDC, JWT, sessions — the auth thread every backend and fullstack loop probes.
- 3
XSS, CSRF, CORS, CSP — the fullstack gap this collection previously lacked.
- 4
OWASP API Top 10, injection, SSRF, and abuse — the backend engineer's security checklist.
- 5
Service-to-service trust, secrets, and zero-trust — for distributed systems and platform engineers.
- 6
PII, encryption, retention, and GDPR — the data engineer and backend engineer view.
- 7
Dependencies, CI/CD hygiene, and incident response — what every senior engineer owns.
- 8
LLM app security, cryptography awareness, and compliance frameworks — optional depth.