OWASP Top 10, SAST/DAST, and secure coding practices.
7 questions in Security & InfoSec.
Start a secure code review of AI-generated code at the trust boundaries, not at line one. Find where untrusted input enters and where it reaches a query, a shell, a file path or an authorisation decision, then check what is missing between them as hard as what is present.
SAST vs DAST vs SCA compares three partial security views: SAST reviews source code, DAST tests a running app and SCA checks dependencies. Each misses business-logic flaws and each needs triage, ownership and release policy to matter.
Secure-by-default framework design wins because it removes the vulnerability class from the option space entirely, while training relies on every developer remembering every rule on every request; the two are not actually substitutes, since training is still needed for what the framework cannot enforce.
Vulnerability scanner backlog triage should rank findings by exploitability, reachability, asset criticality and fix leverage instead of CVSS alone. Group duplicates by root cause, separate release blockers from tracked debt and assign owners.
Start from where untrusted bytes enter, not from line one. Rank the parsers and decoders that turn attacker input into lengths and indices, build them with AddressSanitizer and UBSan, fuzz those entry points, and use crash reports and git history to point at the exact access that goes wrong.
A DDoS or 100x traffic spike needs load shedding that separates real users from abusive or low-value work. Absorb volume at the edge, serve cacheable requests, protect checkout paths and reject expensive new work quickly before queues amplify retries.
A WAF false positive during checkout should be debugged rule by rule, not by disabling the whole web application firewall. Compare checkout funnel shape, source spread and per-rule block counters, then move only the offending rule to log-only mode. It also connects false positives to the point an interviewer is testing.