[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:backend\u002Fsecurity":4,"config":254},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":148,"samples":168},"backend","Backend","","security","Security","en",75,3300,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,36,39,42,45,48,51,54,57,60,63,66,69,72,75,78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,129,132,135,138,141,144,145],{"key":19,"name":20,"count":11},"api-design","API Design",{"key":22,"name":23,"count":11},"caching","Caching",{"key":25,"name":26,"count":11},"concurrency","Concurrency",{"key":28,"name":29,"count":11},"csharp-concurrency-async","Csharp Concurrency Async",{"key":31,"name":32,"count":11},"csharp-exceptions","Csharp Exceptions",{"key":34,"name":35,"count":11},"csharp-generics-interfaces","Csharp Generics Interfaces",{"key":37,"name":38,"count":11},"csharp-memory-performance","Csharp Memory Performance",{"key":40,"name":41,"count":11},"csharp-stdlib-http","Csharp Stdlib Http",{"key":43,"name":44,"count":11},"csharp-testing-tooling","Csharp Testing Tooling",{"key":46,"name":47,"count":11},"databases-sql","Databases \u002F SQL",{"key":49,"name":50,"count":11},"go-concurrency","Go Concurrency",{"key":52,"name":53,"count":11},"go-errors","Go Errors",{"key":55,"name":56,"count":11},"go-interfaces-generics","Go Interfaces Generics",{"key":58,"name":59,"count":11},"go-memory-performance","Go Memory Performance",{"key":61,"name":62,"count":11},"go-stdlib-http","Go Stdlib Http",{"key":64,"name":65,"count":11},"go-testing-tooling","Go Testing Tooling",{"key":67,"name":68,"count":11},"java-concurrency","Java Concurrency",{"key":70,"name":71,"count":11},"java-exceptions","Java Exceptions",{"key":73,"name":74,"count":11},"java-generics-interfaces","Java Generics Interfaces",{"key":76,"name":77,"count":11},"java-memory-jvm","Java Memory Jvm",{"key":79,"name":80,"count":11},"java-stdlib-http","Java Stdlib Http",{"key":82,"name":83,"count":11},"java-testing-tooling","Java Testing Tooling",{"key":85,"name":86,"count":11},"messaging-queues","Messaging \u002F Queues",{"key":88,"name":89,"count":11},"networking-http","Networking \u002F HTTP",{"key":91,"name":92,"count":11},"nodejs-error-handling","Nodejs Error Handling",{"key":94,"name":95,"count":11},"nodejs-event-loop-async","Nodejs Event Loop Async",{"key":97,"name":98,"count":11},"nodejs-memory-performance","Nodejs Memory Performance",{"key":100,"name":101,"count":11},"nodejs-modules-streams","Nodejs Modules Streams",{"key":103,"name":104,"count":11},"nodejs-stdlib-http","Nodejs Stdlib Http",{"key":106,"name":107,"count":11},"nodejs-testing-tooling","Nodejs Testing Tooling",{"key":109,"name":110,"count":11},"php-concurrency-async","Php Concurrency Async",{"key":112,"name":113,"count":11},"php-exceptions","Php Exceptions",{"key":115,"name":116,"count":11},"php-generics-interfaces","Php Generics Interfaces",{"key":118,"name":119,"count":11},"php-memory-performance","Php Memory Performance",{"key":121,"name":122,"count":11},"php-stdlib-http","Php Stdlib Http",{"key":124,"name":125,"count":11},"php-testing-tooling","Php Testing Tooling",{"key":127,"name":128,"count":11},"python-concurrency-async","Python Concurrency Async",{"key":130,"name":131,"count":11},"python-errors-context","Python Errors Context",{"key":133,"name":134,"count":11},"python-memory-performance","Python Memory Performance",{"key":136,"name":137,"count":11},"python-stdlib-http","Python Stdlib Http",{"key":139,"name":140,"count":11},"python-testing-tooling","Python Testing Tooling",{"key":142,"name":143,"count":11},"python-typing-oop","Python Typing Oop",{"key":8,"name":9,"count":11},{"key":146,"name":147,"count":11},"testing","Testing",[149,153,156,159,162,165],{"key":150,"name":151,"count":152},"csharp","C#\u002F.NET",450,{"key":154,"name":155,"count":152},"go","Go",{"key":157,"name":158,"count":152},"java","Java",{"key":160,"name":161,"count":152},"nodejs","Node.js",{"key":163,"name":164,"count":152},"php","PHP",{"key":166,"name":167,"count":152},"python","Python",[169,187,200,214,227,241],{"id":170,"topic":9,"difficulty":171,"body":172,"options":173,"correct_key":178,"explanation":186},"019f56bb-b3ad-73e1-9b02-1dabab634eb8",1,"What is the difference between authentication and authorization?",[174,177,180,183],{"key":175,"text":176},"a","Authentication decides what a user may access; authorization verifies their identity",{"key":178,"text":179},"b","Authentication verifies who the user is; authorization decides what they are allowed to do",{"key":181,"text":182},"c","They are two different names for the same security process",{"key":184,"text":185},"d","Authentication is used for people; authorization is used only for other services","Authentication answers \"who are you?\" (login, credentials); authorization answers \"what may you do?\" (permissions, roles). Option (a) states it exactly backwards, which is the most common confusion between the two terms.",{"id":188,"topic":9,"difficulty":171,"body":189,"options":190,"correct_key":181,"explanation":199},"019f56bb-b3ad-7cb3-a3f9-8702973b888d","What is the fundamental difference between hashing and encryption?",[191,193,195,197],{"key":175,"text":192},"Hashing is faster; apart from speed they provide the same guarantees",{"key":178,"text":194},"Encryption is one-way, while a hash can be reversed with the right key",{"key":181,"text":196},"Hashing is one-way by design; encryption is reversible by whoever has the key",{"key":184,"text":198},"Hashing only works on passwords; encryption works on any kind of data","A hash is a one-way digest: there is no key and no decrypt operation. Encryption is designed to be reversed with the key. Option (b) swaps the two concepts, and (d) is wrong because both operate on arbitrary data.",{"id":201,"topic":9,"difficulty":202,"body":203,"options":204,"correct_key":175,"explanation":213},"019f56bb-b3ae-72fd-9b3b-9f13ff35cfc1",2,"A support lead requests a screen where agents can see a customer's current password to help them log in. Why must this request be rejected?",[205,207,209,211],{"key":175,"text":206},"Properly stored passwords are one-way hashed and cannot be shown",{"key":178,"text":208},"It is acceptable as long as the screen is limited to senior support agents",{"key":181,"text":210},"It is acceptable if every password view is recorded in an audit log",{"key":184,"text":212},"It is fine if the screen is only ever served over an HTTPS connection","Passwords must be stored as salted, slow one-way hashes, so a correctly built system is technically unable to display them. If a system can show a password, it is storing passwords wrong. Restricting viewers (b) or the transport (d) does not fix that root problem — support should trigger a password reset instead. Audit logging (c) records the abuse; it does not remove the exposure.",{"id":215,"topic":9,"difficulty":202,"body":216,"options":217,"correct_key":184,"explanation":226},"019f56bb-b3ae-79d1-8a75-82c71999b8b9","In password hashing, what does a unique per-user salt provide?",[218,220,222,224],{"key":175,"text":219},"It encrypts the stored hash so it cannot be read from the database",{"key":178,"text":221},"It slows the hash function down, which is what blocks brute force by making each guess costly",{"key":181,"text":223},"It allows the server to recover the original password when required",{"key":184,"text":225},"Identical passwords get different hashes, and precomputed hash tables stop working","The salt individualizes every hash: two users with the same password store different values, and attackers cannot use precomputed (rainbow) tables built in advance. Slowness (b) comes from the algorithm's cost factor, not from the salt, and nothing about hashing is reversible (c).",{"id":228,"topic":9,"difficulty":229,"body":230,"options":231,"correct_key":178,"explanation":240},"019f56bb-b3af-7168-be35-fdcf9ea21ca5",3,"A user clicks \"log out\" and the app deletes the session cookie in the browser. A copy of the old cookie value captured earlier still works against the API. What is the flaw?",[232,234,236,238],{"key":175,"text":233},"The cookie was missing the Secure flag, so the browser could not delete it properly",{"key":178,"text":235},"Logout only removed the cookie on the client; the session was never invalidated on the server",{"key":181,"text":237},"Nothing is wrong — a session can only end when its TTL expires",{"key":184,"text":239},"The session id should have been kept in localStorage, which logout can clear reliably","Logging out must invalidate the session server-side (delete or mark the session record) so that every copy of the identifier dies with it. Deleting the browser's cookie only affects that one client. Option (c) is wrong precisely because server-side session stores exist to allow immediate revocation.",{"id":242,"topic":9,"difficulty":171,"body":243,"options":244,"correct_key":181,"explanation":253},"019f56bb-b3af-7c2a-97d9-67575bfeebda","What happens in a typical stored XSS attack?",[245,247,249,251],{"key":175,"text":246},"The attacker floods the server with requests until it stops responding",{"key":178,"text":248},"The attacker reads arbitrary files such as configuration files directly from the server's disk",{"key":181,"text":250},"Attacker-supplied script is saved by the application and later runs in other users' browsers",{"key":184,"text":252},"The attacker intercepts and modifies traffic between the user and the server","In stored XSS, malicious script submitted as content (a comment, a profile field) is persisted and served to other users, executing in their browsers with the site's privileges. It is a client-side code execution issue — not server file access (b) or traffic interception (d).",{"fields":255,"seniorities":424,"interview_shapes":425,"locales":430,"oauth":432,"question_count":435,"coach_enabled":436,"jd_match_enabled":436},[256,267,287,303,327,340,359,378,398,405,411,418],{"key":5,"name_tr":6,"name_en":6,"sort":171,"specializations":257},[258,261,262,263,264,265,266],{"key":259,"name":260,"field":5},"general","Genel",{"key":154,"name":155,"field":5},{"key":166,"name":167,"field":5},{"key":157,"name":158,"field":5},{"key":150,"name":151,"field":5},{"key":160,"name":161,"field":5},{"key":163,"name":164,"field":5},{"key":268,"name_tr":269,"name_en":269,"sort":202,"specializations":270},"frontend","Frontend",[271,272,275,278,281,284],{"key":259,"name":260,"field":268},{"key":273,"name":274,"field":268},"javascript","JavaScript",{"key":276,"name":277,"field":268},"typescript","TypeScript",{"key":279,"name":280,"field":268},"react","React",{"key":282,"name":283,"field":268},"vue","Vue",{"key":285,"name":286,"field":268},"angular","Angular",{"key":288,"name_tr":289,"name_en":289,"sort":229,"specializations":290},"fullstack","Fullstack",[291,292,293,294,295,296,297,298,299,300,301,302],{"key":259,"name":260,"field":288},{"key":154,"name":155,"field":5},{"key":166,"name":167,"field":5},{"key":157,"name":158,"field":5},{"key":150,"name":151,"field":5},{"key":160,"name":161,"field":5},{"key":163,"name":164,"field":5},{"key":273,"name":274,"field":268},{"key":276,"name":277,"field":268},{"key":279,"name":280,"field":268},{"key":282,"name":283,"field":268},{"key":285,"name":286,"field":268},{"key":304,"name_tr":305,"name_en":305,"sort":306,"specializations":307},"devops-cloud","DevOps \u002F Cloud",4,[308,309,312,315,318,321,324],{"key":259,"name":260,"field":304},{"key":310,"name":311,"field":304},"aws","AWS",{"key":313,"name":314,"field":304},"gcp","GCP",{"key":316,"name":317,"field":304},"azure","Azure",{"key":319,"name":320,"field":304},"kubernetes","Kubernetes",{"key":322,"name":323,"field":304},"terraform","Terraform",{"key":325,"name":326,"field":304},"linux","Linux",{"key":328,"name_tr":329,"name_en":329,"sort":330,"specializations":331},"ai-engineer","AI Engineer",5,[332,333,334,337],{"key":259,"name":260,"field":328},{"key":166,"name":167,"field":328},{"key":335,"name":336,"field":328},"llm-rag","LLM\u002FRAG",{"key":338,"name":339,"field":328},"mlops","MLOps",{"key":341,"name_tr":342,"name_en":343,"sort":344,"specializations":345},"database","Veritabanı","Database",6,[346,347,350,353,356],{"key":259,"name":260,"field":341},{"key":348,"name":349,"field":341},"postgresql","PostgreSQL",{"key":351,"name":352,"field":341},"mysql","MySQL",{"key":354,"name":355,"field":341},"mongodb","MongoDB",{"key":357,"name":358,"field":341},"redis","Redis",{"key":360,"name_tr":361,"name_en":362,"sort":363,"specializations":364},"mobile","Mobil","Mobile",7,[365,366,369,372,375],{"key":259,"name":260,"field":360},{"key":367,"name":368,"field":360},"ios-swift","iOS (Swift)",{"key":370,"name":371,"field":360},"android-kotlin","Android (Kotlin)",{"key":373,"name":374,"field":360},"flutter","Flutter",{"key":376,"name":377,"field":360},"react-native","React Native",{"key":8,"name_tr":379,"name_en":9,"sort":380,"specializations":381},"Güvenlik",8,[382,383,386,389,392,395],{"key":259,"name":260,"field":8},{"key":384,"name":385,"field":8},"appsec","AppSec",{"key":387,"name":388,"field":8},"offensive-pentest","Offensive \u002F Pentest",{"key":390,"name":391,"field":8},"cloud-security","Cloud Security",{"key":393,"name":394,"field":8},"devsecops","DevSecOps",{"key":396,"name":397,"field":8},"blue-team-incident","Blue Team \u002F Incident",{"key":399,"name_tr":400,"name_en":401,"sort":402,"specializations":403},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[404],{"key":259,"name":260,"field":399},{"key":406,"name_tr":407,"name_en":407,"sort":408,"specializations":409},"data-engineer","Data Engineer",10,[410],{"key":259,"name":260,"field":406},{"key":412,"name_tr":413,"name_en":414,"sort":415,"specializations":416},"game-dev","Oyun Geliştirme","Game Development",11,[417],{"key":259,"name":260,"field":412},{"key":419,"name_tr":420,"name_en":420,"sort":421,"specializations":422},"ml-engineer","ML Engineer",12,[423],{"key":259,"name":260,"field":419},[14,15,16],{"junior":426,"mid":428,"senior":429},{"questions":427,"median_sec":3},20,{"questions":427,"median_sec":3},{"questions":427,"median_sec":3},[431,10],"tr",[433,434],"google","github",21750,true]