Observability & Security
Two topics interviewers love to end on: "how would you know it's broken?" and "how do you keep it safe?". Mentioning concrete metrics, SLOs and security controls is what separates a senior answer from a junior one.
- C6.1Logs, metrics and tracesWhat Answers Example Metrics Numbers over time, cheap to store and aggregate "Is something wrong? How bad?"…
- C6.2SLIs, SLOs, SLAs and error budgetsSLI (indicator): a measured number, e.g. "the fraction of requests faster than 300 ms" or "the fraction that succeeded". SLO (objective):…
- C6.3Authentication: proving who you arePasswords are never stored, only slow, salted hashes (bcrypt, scrypt, Argon2). A fast hash like SHA-256 can be brute-forced by GPUs.…
- C6.4Authorization: what you're allowed to doAuthentication says who you are; authorization says what you can do. The most common real-world security bug is a missing authorization…
- C6.5Abuse prevention and protecting dataRate limiting per user, IP and API key (Chapter 4), plus CAPTCHAs on sign-up and other abuse-prone flows. DDoS: absorb volumetric attacks…