Loading…
0+ curated questions with the same answer shape every time: quick recap, deep dive, pitfalls, and follow-ups. Coverage includes .
Authentication security, secrets management, and static analysis are tested in security-conscious Rails interviews. This module covers secrets management (Rails.application.credentials and the master.key workflow, environment variables in production, AWS Secrets Manager for rotation), bundler-audit for CVE scanning of gem dependencies (how to integrate in CI and what to do on a hit), Brakeman for Rails-specific SAST (what it detects — mass assignment, SQLi, XSS, redirect, command injection — and false positive triage), JWT security deep-dive (algorithm confusion attack where alg:none or HS256/RS256 swap allows forging tokens, always specify algorithm explicitly), bcrypt via has_secure_password and work factor, timing-safe comparison with ActiveSupport::SecurityUtils.secure_compare, and Dependabot for automated dependency updates.
Full catalog
Topics are ordered for learning. Within each topic, rows are numbered 1–0 globally so you always know where you are. Collapse topics if you want a lighter view — use Expand all when you need the full list again.
Numbers 1–0 follow the order we recommend — click any row to open the full answer, or use the sticky Next link at the bottom of each page to go Q1 → Q0.