[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fappsec":4,"config":232},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":7,"topic_name":7,"spec_key":8,"spec_name":9,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":133,"samples":147},"security","Security","","appsec","AppSec","en",450,2850,[14,15,16],"junior","mid","senior",[18,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130],{"key":19,"name":20,"count":21},"as-access-control-idor","As Access Control Idor",75,{"key":23,"name":24,"count":21},"as-api-security","As Api Security",{"key":26,"name":27,"count":21},"as-authentication-session","As Authentication Session",{"key":29,"name":30,"count":21},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":32,"name":33,"count":21},"as-injection-input-validation","As Injection Input Validation",{"key":35,"name":36,"count":21},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":38,"name":39,"count":21},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":41,"name":42,"count":21},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":44,"name":45,"count":21},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":47,"name":48,"count":21},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":50,"name":51,"count":21},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":53,"name":54,"count":21},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":56,"name":57,"count":21},"cse-container-workload-security","Cse Container Workload Security",{"key":59,"name":60,"count":21},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":62,"name":63,"count":21},"cse-data-protection-governance","Cse Data Protection Governance",{"key":65,"name":66,"count":21},"cse-detection-incident-response","Cse Detection Incident Response",{"key":68,"name":69,"count":21},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":71,"name":72,"count":21},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":74,"name":75,"count":21},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":77,"name":78,"count":21},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":80,"name":81,"count":21},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":83,"name":84,"count":21},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":86,"name":87,"count":21},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":89,"name":90,"count":21},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":92,"name":93,"count":21},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":95,"name":96,"count":21},"pt-methodology-phases","Pt Methodology Phases",{"key":98,"name":99,"count":21},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":101,"name":102,"count":21},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":104,"name":105,"count":21},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":107,"name":108,"count":21},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":110,"name":111,"count":21},"security-authn-authz","Security Authn Authz",{"key":113,"name":114,"count":21},"security-cloud-infra-security","Security Cloud Infra Security",{"key":116,"name":117,"count":21},"security-compliance-risk","Security Compliance Risk",{"key":119,"name":120,"count":21},"security-cryptography-basics","Security Cryptography Basics",{"key":122,"name":123,"count":21},"security-incident-response","Security Incident Response",{"key":125,"name":126,"count":21},"security-network-security","Security Network Security",{"key":128,"name":129,"count":21},"security-secure-sdlc","Security Secure Sdlc",{"key":131,"name":132,"count":21},"security-web-vulnerabilities","Security Web Vulnerabilities",[134,135,138,141,144],{"key":8,"name":9,"count":11},{"key":136,"name":137,"count":11},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":11},"cloud-security","Cloud Security",{"key":142,"name":143,"count":11},"devsecops","DevSecOps",{"key":145,"name":146,"count":11},"offensive-pentest","Offensive \u002F Pentest",[148,166,180,193,206,219],{"id":149,"topic":20,"difficulty":150,"body":151,"options":152,"correct_key":160,"explanation":165},"019faa33-102d-73b1-8e23-54539821ab52",1,"What does \"broken access control\" mean as a vulnerability category?",[153,156,159,162],{"key":154,"text":155},"a","The login form does not validate the password format strictly enough",{"key":157,"text":158},"b","The TLS certificate on the login page is expired",{"key":160,"text":161},"c","An authenticated user can act on data or functions they should not be permitted to reach",{"key":163,"text":164},"d","The database connection pool runs out of available connections under load, causing intermittent timeouts across all endpoints.","Broken access control describes failures in enforcing what an already-identified user is allowed to do — the system correctly knows who is calling but fails to correctly restrict what that caller can read or change, which is why it has topped the OWASP Top 10 in recent editions.",{"id":167,"topic":20,"difficulty":168,"body":169,"options":170,"correct_key":157,"explanation":179},"019faa33-1041-7dc7-9471-4188cd4b897a",2,"An invoice detail page is reached via `\u002Finvoices\u002F482`. A logged-in user changes the URL to `\u002Finvoices\u002F481` and sees another customer's invoice. What is the underlying flaw?",[171,173,175,177],{"key":154,"text":172},"The invoice numbers are not encrypted in the URL",{"key":157,"text":174},"The server does not verify that the requesting user owns invoice 481 before returning it",{"key":160,"text":176},"The session cookie is missing the `Secure` flag",{"key":163,"text":178},"The invoice IDs are sequential integers instead of random strings, which alone lets any authenticated user enumerate every invoice.","This is a textbook Insecure Direct Object Reference (IDOR): the server trusts the ID from the request and fetches the matching row without checking that the authenticated user is the owner of that record. Making IDs non-sequential would only add obscurity, not fix the missing ownership check.",{"id":181,"topic":20,"difficulty":168,"body":182,"options":183,"correct_key":154,"explanation":192},"019faa33-1044-7336-9f23-7b824dde1abe","What is the difference between horizontal and vertical privilege escalation?",[184,186,188,190],{"key":154,"text":185},"Horizontal means accessing another user's data at the same privilege level.",{"key":157,"text":187},"Horizontal means gaining admin rights; vertical means reading another tenant's rows",{"key":160,"text":189},"They both describe the same attack, just named differently by different vendors",{"key":163,"text":191},"Horizontal applies to REST APIs and vertical applies only to GraphQL APIs","Horizontal escalation is a regular user reaching another regular user's resources (same rank, wrong owner) — like the invoice example. Vertical escalation is a regular user reaching functionality reserved for a higher role, such as an ordinary user calling an admin-only endpoint.",{"id":194,"topic":20,"difficulty":150,"body":195,"options":196,"correct_key":157,"explanation":205},"019faa33-1045-7575-95a5-d86c5c53159e","Why is hiding an \"Admin Settings\" button in the frontend for non-admin users not a real access control mechanism on its own?",[197,199,201,203],{"key":154,"text":198},"Because frontend code cannot render conditional UI at all, so any hidden element is a rendering bug rather than a design choice.",{"key":157,"text":200},"Because the underlying API endpoint is still reachable directly.",{"key":160,"text":202},"Because every browser ignores CSS `display:none`",{"key":163,"text":204},"Because hidden buttons cause browser rendering errors","UI hiding is a usability nicety, not a security boundary — any client can call the backend endpoint directly (via devtools, curl, or a proxy) bypassing the button entirely. The actual authorization decision must be enforced server-side, on every request.",{"id":207,"topic":20,"difficulty":168,"body":208,"options":209,"correct_key":163,"explanation":218},"019faa33-1046-7857-ae4d-c054795b3370","A SaaS product stores all customers' data in one shared `orders` table with a `tenant_id` column. A bug causes an API query to omit the `WHERE tenant_id = ?` filter for one endpoint. What is the direct consequence?",[210,212,214,216],{"key":154,"text":211},"Query performance degrades but data remains isolated",{"key":157,"text":213},"Only read operations are affected, writes remain isolated by default",{"key":160,"text":215},"The database enforces tenant isolation automatically, since every table has a foreign key to the tenant.",{"key":163,"text":217},"One tenant's request can return or affect rows belonging to a different tenant","In a shared-schema multi-tenant design, tenant isolation lives entirely in application query logic (or database-level row security) — nothing else stops a query without the tenant filter from touching every tenant's rows, making this a direct cross-tenant data leak, and it can affect writes just as easily as reads.",{"id":220,"topic":20,"difficulty":150,"body":221,"options":222,"correct_key":163,"explanation":231},"019faa33-1047-7da5-9d8a-c67b55851f74","In Role-Based Access Control (RBAC), what determines whether a request is allowed?",[223,225,227,229],{"key":154,"text":224},"The current time of day the request was made",{"key":157,"text":226},"Whether the request came from an internal IP address",{"key":160,"text":228},"The length of the user's password",{"key":163,"text":230},"The role(s) assigned to the user and whether that role has the required permission","RBAC grants permissions to roles, and roles are assigned to users; an access decision checks whether any role held by the requesting user includes the permission needed for the action, rather than evaluating individual user attributes.",{"fields":233,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[234,259,279,296,320,333,352,371,381,388,394,401],{"key":235,"name_tr":236,"name_en":236,"sort":150,"specializations":237},"backend","Backend",[238,241,244,247,250,253,256],{"key":239,"name":240,"field":235},"general","Genel",{"key":242,"name":243,"field":235},"go","Go",{"key":245,"name":246,"field":235},"python","Python",{"key":248,"name":249,"field":235},"java","Java",{"key":251,"name":252,"field":235},"csharp","C#\u002F.NET",{"key":254,"name":255,"field":235},"nodejs","Node.js",{"key":257,"name":258,"field":235},"php","PHP",{"key":260,"name_tr":261,"name_en":261,"sort":168,"specializations":262},"frontend","Frontend",[263,264,267,270,273,276],{"key":239,"name":240,"field":260},{"key":265,"name":266,"field":260},"javascript","JavaScript",{"key":268,"name":269,"field":260},"typescript","TypeScript",{"key":271,"name":272,"field":260},"react","React",{"key":274,"name":275,"field":260},"vue","Vue",{"key":277,"name":278,"field":260},"angular","Angular",{"key":280,"name_tr":281,"name_en":281,"sort":282,"specializations":283},"fullstack","Fullstack",3,[284,285,286,287,288,289,290,291,292,293,294,295],{"key":239,"name":240,"field":280},{"key":242,"name":243,"field":235},{"key":245,"name":246,"field":235},{"key":248,"name":249,"field":235},{"key":251,"name":252,"field":235},{"key":254,"name":255,"field":235},{"key":257,"name":258,"field":235},{"key":265,"name":266,"field":260},{"key":268,"name":269,"field":260},{"key":271,"name":272,"field":260},{"key":274,"name":275,"field":260},{"key":277,"name":278,"field":260},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":239,"name":240,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":239,"name":240,"field":321},{"key":245,"name":246,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":239,"name":240,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":239,"name":240,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":239,"name":240,"field":5},{"key":8,"name":9,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":239,"name":240,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":239,"name":240,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":239,"name":240,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":239,"name":240,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]