A product team wants to ship a feature next week that you believe has a serious security gap. How do you handle it?

What the interviewer is looking for

• This question tests collaboration & influence. Works with engineers as partners, offers practical alternatives, and finds compromises that reduce risk without stalling delivery.
• What to bring out: Explains the concrete risk, proposes practical mitigations or a reduced scope, escalates with a clear risk statement if needed, and keeps the relationship constructive.
• Expect a follow-up like: What if leadership decides to accept the risk and ship anyway?

Another way it may be asked: You find a big security problem in something launching soon, and the team does not want to delay. What do you do?

A structure to follow: STAR, with the weight on Action and Result

1. Step 1

   Situation

   One or two sentences: where, when and what was at stake. Pick a real example you were close to.

2. Step 2

   Task

   What you personally were responsible for. Say "I", not only "we", so the collaboration & influence you showed is visible.

3. Step 3

   Action

   The two or three things you did and why you chose them over the alternatives. This should be about half your answer.

4. Step 4

   Result

   What changed, in your own measure of it, and what you would do differently. Only use numbers you can stand behind.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Describing what the team did without saying what you did.
• Choosing an example with no clear outcome, or one you cannot answer detailed questions about.
• Ending on the action and skipping the result and what you learned.

How to practise it

Write two bullet points for each STAR letter, then say the answer aloud in about two minutes.

Related questions

• What is SQL injection, how does it happen, and how would you prevent it in a web application?
• Why is multi-factor authentication important, and which kinds of second factor are stronger than others?
• You notice a user account logging in from two countries an hour apart. What would you check, and what would you do?
• A scanner reports three thousand vulnerabilities across your systems. How do you decide what to fix first?
• Walk me through how you would threat model a new feature that lets users upload files to share with others.

Browse all questions