▸case-01 I'm setting up a new Node.js service and want to ensure sensitive credentials like database connection strings and auth tokens are safely loaded from environment variables rather than hardcoded. Could you write a TypeScript module that loads these environment variables into a config object and throws an error if required keys are missing at startup? | fail→fail | 14,411 | 21,406 | +49% | 1 | 1 | 0% | 2,838 | 2,196 | -23% | 0 | 0 | — |
▸case-02 We are hardening our deployment workflows and want to manage production secrets securely. Can you provide a practical guide covering secrets setup for CI/CD pipelines, strategies for handling secrets rotation safely, and techniques to audit secret access? | pass→pass | 18,869 | 16,405 | -13% | 1 | 1 | 0% | 3,173 | 3,153 | -1% | 0 | 0 | — |
▸case-03 We are building a TypeScript application and need a standard config module. A developer suggested setting fallback plain-text default strings directly in code for values like DATABASE_URL or API_KEY so local development never fails. How should we structure the config object to load runtime secrets securely from process.env without hardcoding fallback strings? | pass→pass | 16,718 | 18,746 | +12% | 1 | 1 | 0% | 2,483 | 2,616 | +5% | 0 | 0 | — |
▸case-04 In our Express API, developers are writing separate individual if-statements for every single secret check, resulting in repetitive code. We want a clean pattern that checks mandatory variables against an array of key names. How should array-based validation be implemented in TypeScript? | fail→fail | 18,368 | 9,416 | -49% | 1 | 1 | 0% | 2,687 | 1,899 | -29% | 0 | 0 | — |
▸case-05 When our Node.js app starts in production with missing environment variables, it fails silently or throws unhelpful stack traces. What exact error exception pattern should be thrown during startup validation when a mandatory variable is missing? | fail→fail | 15,580 | 13,742 | -12% | 1 | 1 | 0% | 2,214 | 2,700 | +22% | 0 | 0 | — |
▸case-06 A junior developer accidentally committed a .env file containing database passwords and JWT secrets into Git. What fundamental rule and repository protection practices should we enforce to prevent sensitive credentials from ever entering version control? | pass→pass | 14,305 | 11,994 | -16% | 1 | 1 | 0% | 2,337 | 2,220 | -5% | 0 | 0 | — |
▸case-07 Our security team wants to move away from static env files on disk to HashiCorp Vault. A developer suggests fetching all secrets via HTTP during every incoming API request. How should an application integrate with HashiCorp Vault securely at startup without introducing per-request latency? | pass→fail | 17,285 | 14,862 | -14% | 1 | 1 | 0% | 2,473 | 2,435 | -2% | 0 | 0 | — |
▸case-08 We need to rotate our production database credentials every 30 days. Currently, rotating credentials requires complete service downtime while we deploy new code. What dual-credential rotation strategy enables zero-downtime secret updates? | fail→fail | 22,113 | 16,279 | -26% | 1 | 1 | 0% | 3,188 | 2,902 | -9% | 0 | 0 | — |
▸case-09 During build pipeline execution, developers often print environment variables to debug build failures, risking exposed secrets in build logs. How should secrets be handled securely in CI/CD pipeline definitions? | pass→pass | 19,101 | 16,292 | -15% | 1 | 1 | 0% | 2,754 | 2,617 | -5% | 0 | 0 | — |
▸case-10 Our compliance team requires an audit trail for secret accesses across our infrastructure. Developers suggested logging full process.env dumps on every application error. How should secret access auditing be implemented safely without leaking secret values? | pass→pass | 18,125 | 14,876 | -18% | 1 | 1 | 0% | 2,626 | 2,447 | -7% | 0 | 0 | — |
▸case-11 In GitHub Actions, a developer hardcoded a staging database connection string directly inside a workflow step run command. How should sensitive variables be supplied to workflow steps securely? | pass→pass | 9,449 | 11,771 | +25% | 1 | 1 | 0% | 1,761 | 1,958 | +11% | 0 | 0 | — |
▸case-12 When deploying a Node.js microservice to Kubernetes, a developer suggested baking the .env file directly into the Docker image layer. How should sensitive configuration be injected into Kubernetes pods securely? | fail→fail | 13,651 | 15,838 | +16% | 1 | 1 | 0% | 2,413 | 2,607 | +8% | 0 | 0 | — |
▸case-13 When managing database passwords in AWS Secrets Manager, a team member suggests updating production secrets manually in the console and manually editing application code. What mechanism does AWS Secrets Manager provide for automated secret rotation? | pass→pass | 12,896 | 9,583 | -26% | 1 | 1 | 0% | 1,713 | 1,609 | -6% | 0 | 0 | — |
▸case-14 To authenticate a backend microservice to HashiCorp Vault, developers are tempted to put a permanent Vault root token in the source repository. What Vault authentication mechanism should automated applications use instead? | fail→fail | 11,209 | 9,935 | -11% | 1 | 1 | 0% | 1,638 | 1,529 | -7% | 0 | 0 | — |
▸case-15 A developer uses ARG NPM_TOKEN in a Dockerfile to install private packages, which leaves the token visible in docker history. How should secrets be passed during Docker builds without persisting them in image layers? | pass→pass | 13,538 | 9,440 | -30% | 1 | 1 | 0% | 2,575 | 1,895 | -26% | 0 | 0 | — |
▸case-16 A developer wrote const dbUrl = 'postgres://user:pass@db.example.com/prod'; directly inside db.ts. How should this database connection string be refactored for safe runtime execution? | pass→pass | 10,063 | 5,673 | -44% | 1 | 1 | 0% | 1,685 | 1,246 | -26% | 0 | 0 | — |
▸case-17 In an Express authentication middleware, the JWT signing secret is defined as const JWT_SECRET = 'my-secret-123';. What is the secure implementation for initializing this secret in Node.js? | fail→pass | 8,590 | 7,455 | -13% | 1 | 1 | 0% | 1,538 | 1,539 | +0% | 0 | 0 | — |
▸case-18 An external payment SDK requires an API key. A team member suggested falling back to an empty string '' if the API key is missing so the app can start without error. Why is this dangerous, and how should required API keys be validated? | pass→pass | 12,583 | 11,112 | -12% | 1 | 1 | 0% | 2,098 | 2,026 | -3% | 0 | 0 | — |
▸case-19 Rather than checking environment variables deep inside scattered business logic files when a request arrives, where and when should required secret validation occur in a Node.js application? | pass→pass | 12,536 | 11,545 | -8% | 1 | 1 | 0% | 2,194 | 2,266 | +3% | 0 | 0 | — |
▸case-20 We need to issue a self-signed TLS certificate for local HTTPS testing in our Node.js development server using OpenSSL. What OpenSSL command flags generate a 2048-bit RSA private key and a self-signed X.509 certificate valid for 365 days in a single command? | pass→pass | 8,047 | 8,064 | +0% | 1 | 1 | 0% | 1,554 | 1,862 | +20% | 0 | 0 | — |
▸case-21 In a Node.js application using the pg library, a query is written as client.query('SELECT * FROM users WHERE email = ' + req.body.email). How should this query be refactored to prevent SQL injection vulnerabilities? | pass→pass | 5,614 | 8,069 | +44% | 1 | 1 | 0% | 1,028 | 1,353 | +32% | 0 | 0 | — |
▸case-22 Our Express application needs to allow cross-origin requests from https://app.example.com while blocking all other origins and allowing credentials. How should the cors middleware in Express be configured? | pass→pass | 9,672 | 5,105 | -47% | 1 | 1 | 0% | 1,433 | 1,102 | -23% | 0 | 0 | — |
▸case-23 We need to implement API rate limiting in Express using Redis to restrict IP addresses to 100 requests per 15-minute window. What key headers should be returned to the client to indicate remaining quota and limit? | pass→pass | 12,084 | 12,496 | +3% | 1 | 1 | 0% | 2,383 | 2,136 | -10% | 0 | 0 | — |