[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"me":3,"catalog:en:security\u002Fsecurity-secure-sdlc":4,"config":232},null,{"field_key":5,"field_name":6,"seniority":7,"topic_key":8,"topic_name":9,"spec_key":7,"spec_name":7,"locale":10,"cell_total":11,"field_total":12,"seniorities":13,"topics":17,"specs":130,"samples":147},"security","Security","","security-secure-sdlc","Security Secure Sdlc","en",75,2850,[14,15,16],"junior","mid","senior",[18,21,24,27,30,33,36,39,42,45,48,51,54,57,60,63,66,69,72,75,78,81,84,87,90,93,96,99,102,105,108,111,114,117,120,123,126,127],{"key":19,"name":20,"count":11},"as-access-control-idor","As Access Control Idor",{"key":22,"name":23,"count":11},"as-api-security","As Api Security",{"key":25,"name":26,"count":11},"as-authentication-session","As Authentication Session",{"key":28,"name":29,"count":11},"as-crypto-implementation-pitfalls","As Crypto Implementation Pitfalls",{"key":31,"name":32,"count":11},"as-injection-input-validation","As Injection Input Validation",{"key":34,"name":35,"count":11},"as-secure-sdlc-sast-dast","As Secure Sdlc Sast Dast",{"key":37,"name":38,"count":11},"bt-crisis-communication-management","Bt Crisis Communication Management",{"key":40,"name":41,"count":11},"bt-detection-engineering-tuning","Bt Detection Engineering Tuning",{"key":43,"name":44,"count":11},"bt-digital-forensics-fundamentals","Bt Digital Forensics Fundamentals",{"key":46,"name":47,"count":11},"bt-incident-triage-classification","Bt Incident Triage Classification",{"key":49,"name":50,"count":11},"bt-ir-playbook-execution","Bt Ir Playbook Execution",{"key":52,"name":53,"count":11},"bt-threat-intelligence-application","Bt Threat Intelligence Application",{"key":55,"name":56,"count":11},"cse-container-workload-security","Cse Container Workload Security",{"key":58,"name":59,"count":11},"cse-cspm-misconfiguration","Cse Cspm Misconfiguration",{"key":61,"name":62,"count":11},"cse-data-protection-governance","Cse Data Protection Governance",{"key":64,"name":65,"count":11},"cse-detection-incident-response","Cse Detection Incident Response",{"key":67,"name":68,"count":11},"cse-iam-privilege-escalation","Cse Iam Privilege Escalation",{"key":70,"name":71,"count":11},"cse-network-perimeter-zero-trust","Cse Network Perimeter Zero Trust",{"key":73,"name":74,"count":11},"ds-iac-policy-as-code","Ds Iac Policy As Code",{"key":76,"name":77,"count":11},"ds-pipeline-security-gates","Ds Pipeline Security Gates",{"key":79,"name":80,"count":11},"ds-secrets-pipeline-management","Ds Secrets Pipeline Management",{"key":82,"name":83,"count":11},"ds-security-metrics-blameless-culture","Ds Security Metrics Blameless Culture",{"key":85,"name":86,"count":11},"ds-shift-left-security-culture","Ds Shift Left Security Culture",{"key":88,"name":89,"count":11},"ds-software-supply-chain-pipeline","Ds Software Supply Chain Pipeline",{"key":91,"name":92,"count":11},"pt-legal-ethical-boundaries","Pt Legal Ethical Boundaries",{"key":94,"name":95,"count":11},"pt-methodology-phases","Pt Methodology Phases",{"key":97,"name":98,"count":11},"pt-red-team-engagement-management","Pt Red Team Engagement Management",{"key":100,"name":101,"count":11},"pt-reporting-remediation-prioritization","Pt Reporting Remediation Prioritization",{"key":103,"name":104,"count":11},"pt-scoping-rules-of-engagement","Pt Scoping Rules Of Engagement",{"key":106,"name":107,"count":11},"pt-vulnerability-assessment-vs-pentest","Pt Vulnerability Assessment Vs Pentest",{"key":109,"name":110,"count":11},"security-authn-authz","Security Authn Authz",{"key":112,"name":113,"count":11},"security-cloud-infra-security","Security Cloud Infra Security",{"key":115,"name":116,"count":11},"security-compliance-risk","Security Compliance Risk",{"key":118,"name":119,"count":11},"security-cryptography-basics","Security Cryptography Basics",{"key":121,"name":122,"count":11},"security-incident-response","Security Incident Response",{"key":124,"name":125,"count":11},"security-network-security","Security Network Security",{"key":8,"name":9,"count":11},{"key":128,"name":129,"count":11},"security-web-vulnerabilities","Security Web Vulnerabilities",[131,135,138,141,144],{"key":132,"name":133,"count":134},"appsec","AppSec",450,{"key":136,"name":137,"count":134},"blue-team-incident","Blue Team \u002F Incident",{"key":139,"name":140,"count":134},"cloud-security","Cloud Security",{"key":142,"name":143,"count":134},"devsecops","DevSecOps",{"key":145,"name":146,"count":134},"offensive-pentest","Offensive \u002F Pentest",[148,166,180,193,206,219],{"id":149,"topic":9,"difficulty":150,"body":151,"options":152,"correct_key":157,"explanation":165},"019f686c-599f-7261-a000-59f6c7c2bf0a",1,"What is the main purpose of building a threat model for a new system during design?",[153,156,159,162],{"key":154,"text":155},"a","To produce a performance benchmark that predicts how the system will scale under load",{"key":157,"text":158},"b","Identify what could go wrong security-wise and which controls address each concern",{"key":160,"text":161},"c","To generate the final list of test cases the QA team will execute before release",{"key":163,"text":164},"d","To document the API contract so frontend and backend teams can integrate without ambiguity","Threat modeling is a structured exercise: enumerate the assets, the ways an attacker could compromise them, and the controls that mitigate each identified threat. It is a security design activity, not a performance, QA, or API-contract exercise, though its output often feeds into all three.",{"id":167,"topic":9,"difficulty":168,"body":169,"options":170,"correct_key":163,"explanation":179},"019f686c-599f-7985-8d02-dd07c486f571",2,"In a STRIDE-style threat categorization, a threat where an attacker convinces a system that a request came from a legitimate user when it did not is best classified as which category?",[171,173,175,177],{"key":154,"text":172},"Denial of service, because the request consumes system resources",{"key":157,"text":174},"Information disclosure, because the attacker learns something about the user",{"key":160,"text":176},"Elevation of privilege, because the attacker gains extra permissions immediately",{"key":163,"text":178},"Spoofing — the attacker impersonates an identity that is not their own","Spoofing is exactly this: an attacker claims or impersonates an identity (a user, a service, a device) that is not theirs, so the system trusts a request it should not. Elevation of privilege is a separate, later consequence; disclosure and denial of service describe different threat shapes.",{"id":181,"topic":9,"difficulty":168,"body":182,"options":183,"correct_key":154,"explanation":192},"019f686c-59a0-7211-95b5-1adb4038e0f9","A team is about to start building a new feature that handles payment data. When is the best time to run a threat-modeling session for this feature?",[184,186,188,190],{"key":154,"text":185},"During design, before implementation starts, so identified risks can shape the architecture itself",{"key":157,"text":187},"Right after the first production incident involving the feature, to understand what already went wrong",{"key":160,"text":189},"During the final QA regression pass, right before the release is tagged",{"key":163,"text":191},"Only when a customer explicitly asks for a security audit of the feature","Threat modeling is most valuable early, while the design can still be changed cheaply. Waiting for an incident, the final QA pass, or a customer request means the architecture is already fixed, so any finding becomes a costly retrofit instead of a design input.",{"id":194,"topic":9,"difficulty":150,"body":195,"options":196,"correct_key":160,"explanation":205},"019f686c-59a0-77da-9c0a-7688a0fa0cff","What does the term \"shift-left\" mean in the context of secure software development?",[197,199,201,203],{"key":154,"text":198},"Moving the deployment pipeline from one cloud region to another for compliance reasons",{"key":157,"text":200},"Reorganizing the team so security specialists report to the engineering manager instead of a separate department",{"key":160,"text":202},"Addressing security requirements and checks earlier in the development lifecycle rather than only at the end",{"key":163,"text":204},"Rewriting legacy code from an older programming language to a newer one before adding new features","Shift-left means moving activities that traditionally happened late (security review, testing) toward the earlier stages of the lifecycle — requirements, design, coding — so issues are caught and fixed while they are cheap. It is not about reporting lines, regions, or language migration.",{"id":207,"topic":9,"difficulty":168,"body":208,"options":209,"correct_key":157,"explanation":218},"019f686c-59a0-7dcb-9905-a2b22238b735","A missing authorization check is found and fixed while a feature is still in code review, before it merges. Compared to finding the same issue three months after release, why is this outcome preferable?",[210,212,214,216],{"key":154,"text":211},"It is not actually preferable, since the fix requires the same amount of code either way",{"key":157,"text":213},"Cheaper and safer, since no data was exposed yet and no rollback or incident response is needed",{"key":160,"text":215},"It only matters for compliance paperwork, not for the actual security of the system",{"key":163,"text":217},"It is preferable only if the reviewer happens to be more senior than the original author","Catching the flaw before merge means it never reached production: no user data was at risk, no incident response, customer notification, or emergency patch was required. The engineering cost of the fix itself may be similar, but the operational and trust cost of a live vulnerability is far higher.",{"id":220,"topic":9,"difficulty":168,"body":221,"options":222,"correct_key":154,"explanation":231},"019f686c-59a1-7722-94ca-47a3c918c96c","Beyond checking that the code works correctly, what should a reviewer additionally look for during a security-focused code review?",[223,225,227,229],{"key":154,"text":224},"Whether input is validated, access checks are present, and sensitive data is handled safely",{"key":157,"text":226},"Whether the variable names follow the team's preferred naming convention",{"key":160,"text":228},"Whether the pull request description is written in complete sentences",{"key":163,"text":230},"Whether the number of lines changed is small enough to fit on one screen","A security-focused review asks security-specific questions: is untrusted input validated, is authorization enforced at the right layer, are secrets and sensitive data handled and logged safely. Naming style, description prose, and diff size are useful review hygiene but are not security concerns.",{"fields":233,"seniorities":407,"interview_shapes":408,"locales":413,"oauth":415,"question_count":418,"coach_enabled":419,"jd_match_enabled":419},[234,259,279,296,320,333,352,371,381,388,394,401],{"key":235,"name_tr":236,"name_en":236,"sort":150,"specializations":237},"backend","Backend",[238,241,244,247,250,253,256],{"key":239,"name":240,"field":235},"general","Genel",{"key":242,"name":243,"field":235},"go","Go",{"key":245,"name":246,"field":235},"python","Python",{"key":248,"name":249,"field":235},"java","Java",{"key":251,"name":252,"field":235},"csharp","C#\u002F.NET",{"key":254,"name":255,"field":235},"nodejs","Node.js",{"key":257,"name":258,"field":235},"php","PHP",{"key":260,"name_tr":261,"name_en":261,"sort":168,"specializations":262},"frontend","Frontend",[263,264,267,270,273,276],{"key":239,"name":240,"field":260},{"key":265,"name":266,"field":260},"javascript","JavaScript",{"key":268,"name":269,"field":260},"typescript","TypeScript",{"key":271,"name":272,"field":260},"react","React",{"key":274,"name":275,"field":260},"vue","Vue",{"key":277,"name":278,"field":260},"angular","Angular",{"key":280,"name_tr":281,"name_en":281,"sort":282,"specializations":283},"fullstack","Fullstack",3,[284,285,286,287,288,289,290,291,292,293,294,295],{"key":239,"name":240,"field":280},{"key":242,"name":243,"field":235},{"key":245,"name":246,"field":235},{"key":248,"name":249,"field":235},{"key":251,"name":252,"field":235},{"key":254,"name":255,"field":235},{"key":257,"name":258,"field":235},{"key":265,"name":266,"field":260},{"key":268,"name":269,"field":260},{"key":271,"name":272,"field":260},{"key":274,"name":275,"field":260},{"key":277,"name":278,"field":260},{"key":297,"name_tr":298,"name_en":298,"sort":299,"specializations":300},"devops-cloud","DevOps \u002F Cloud",4,[301,302,305,308,311,314,317],{"key":239,"name":240,"field":297},{"key":303,"name":304,"field":297},"aws","AWS",{"key":306,"name":307,"field":297},"gcp","GCP",{"key":309,"name":310,"field":297},"azure","Azure",{"key":312,"name":313,"field":297},"kubernetes","Kubernetes",{"key":315,"name":316,"field":297},"terraform","Terraform",{"key":318,"name":319,"field":297},"linux","Linux",{"key":321,"name_tr":322,"name_en":322,"sort":323,"specializations":324},"ai-engineer","AI Engineer",5,[325,326,327,330],{"key":239,"name":240,"field":321},{"key":245,"name":246,"field":321},{"key":328,"name":329,"field":321},"llm-rag","LLM\u002FRAG",{"key":331,"name":332,"field":321},"mlops","MLOps",{"key":334,"name_tr":335,"name_en":336,"sort":337,"specializations":338},"database","Veritabanı","Database",6,[339,340,343,346,349],{"key":239,"name":240,"field":334},{"key":341,"name":342,"field":334},"postgresql","PostgreSQL",{"key":344,"name":345,"field":334},"mysql","MySQL",{"key":347,"name":348,"field":334},"mongodb","MongoDB",{"key":350,"name":351,"field":334},"redis","Redis",{"key":353,"name_tr":354,"name_en":355,"sort":356,"specializations":357},"mobile","Mobil","Mobile",7,[358,359,362,365,368],{"key":239,"name":240,"field":353},{"key":360,"name":361,"field":353},"ios-swift","iOS (Swift)",{"key":363,"name":364,"field":353},"android-kotlin","Android (Kotlin)",{"key":366,"name":367,"field":353},"flutter","Flutter",{"key":369,"name":370,"field":353},"react-native","React Native",{"key":5,"name_tr":372,"name_en":6,"sort":373,"specializations":374},"Güvenlik",8,[375,376,377,378,379,380],{"key":239,"name":240,"field":5},{"key":132,"name":133,"field":5},{"key":145,"name":146,"field":5},{"key":139,"name":140,"field":5},{"key":142,"name":143,"field":5},{"key":136,"name":137,"field":5},{"key":382,"name_tr":383,"name_en":384,"sort":385,"specializations":386},"qa-test-automation","QA \u002F Test Otomasyonu","QA \u002F Test Automation",9,[387],{"key":239,"name":240,"field":382},{"key":389,"name_tr":390,"name_en":390,"sort":391,"specializations":392},"data-engineer","Data Engineer",10,[393],{"key":239,"name":240,"field":389},{"key":395,"name_tr":396,"name_en":397,"sort":398,"specializations":399},"game-dev","Oyun Geliştirme","Game Development",11,[400],{"key":239,"name":240,"field":395},{"key":402,"name_tr":403,"name_en":403,"sort":404,"specializations":405},"ml-engineer","ML Engineer",12,[406],{"key":239,"name":240,"field":402},[14,15,16],{"junior":409,"mid":411,"senior":412},{"questions":410,"median_sec":3},20,{"questions":410,"median_sec":3},{"questions":410,"median_sec":3},[414,10],"tr",[416,417],"google","github",21750,true]