You find a vulnerability in production code. What do you do?
Answer
- Assess severity and exploitability (can it be reached? what data is exposed?).
- Report it through the proper channel (security team or lead) immediately; don't discuss it publicly.
- Contain: feature flag, WAF rule, rotate exposed secrets.
- Fix it with tests; look for the same pattern elsewhere in the code.
- Check logs for signs it was exploited; involve incident response if needed (legal notification duties).
- Blameless postmortem and preventive controls (linters, SAST, dependency scanning).
Practice this question in Repaso
