Daily habits beat annual pen tests alone—embed security in how you write and review code.
Checklist
- Parameterized SQL; encode output
- Validate file uploads (type, size, storage outside web root)
- Use framework CSRF protection
- Dependency updates weekly
- Security unit tests for auth boundaries
Important interview questions and answers
- Q: File upload risk?
A: Malware storage and path traversal if names not sanitized. - Q: Security test example?
A: User A cannot GET /api/orders/B-id.
Self-check
- Name three secure coding habits.
- File upload risk?
Tip: Add security checklist to PR description template.
Interview prep
- Validate input?
At every trust boundary.