Security Interview Questions 2026
Published July 22, 2026 · Updated July 22, 2026
6 Security interview questions from PayU, Stripe, Apple, Salesforce. All difficulty levels, all roles. Upvoted by engineers who were asked them.
6 questions
Companies: PayU, Stripe, Apple, Salesforce
213 upvotes
Security Questions by Company
PayU (1)
PayU
Hard
System Design round
2–5 YearsInterview ExperienceJavaScriptReactSecurity
Design the frontend architecture for a PayU checkout SDK that can be embedded in any merchant website as a script tag. It must render a payment form in an iframe, handle cross-origin communication, support multiple payment methods (card, UPI, netbanking), and work across React, Vue, and plain HTML merchant sites.
↑ 81 upvotes · 57 engineers asked this · Full Stack Developer
Stripe (2)
Stripe
Hard
Technical round
3-7 yearsSecuritySystem DesignSQL
Explain idempotency keys in a payments API. What specific failure mode do they prevent, and how would you design the storage layer for them so they don't become a bottleneck?
↑ 40 upvotes · 20 engineers asked this · Senior SDE
Stripe
Medium
Technical round
3-6 yearsSecurity
How would you design API key storage so that even if your database is breached, attackers can't use the leaked keys directly?
↑ 25 upvotes · 14 engineers asked this · Senior SDE
Apple (1)
Apple
Medium
Technical round
2-6 yearsSecurityiOS
How would you design a feature that needs user location data for a core function, while minimizing what leaves the device and remains fully functional if the user denies location permission?
↑ 21 upvotes · 8 engineers asked this · Senior SDE
Salesforce (2)
Salesforce
Medium
Technical round
3-6 yearsSecurity
Explain the difference between role-based access control (RBAC) and attribute-based access control (ABAC). Give an example permission requirement that RBAC alone can't express cleanly.
↑ 24 upvotes · 11 engineers asked this · Senior SDE
Salesforce
Hard
Technical round
4-8 yearsSecurity
In a shared-schema multi-tenant database, what specific bug pattern most commonly causes cross-tenant data leaks, and how do you prevent it at the code level, not just by convention?
↑ 22 upvotes · 10 engineers asked this · Senior SDE
Practice these questions with AI feedback
Get instant grading on your answers, identify your weak areas, and generate a personalised 14-day study plan — all free.
Build my study plan →
Frequently asked questions
Design the frontend architecture for a PayU checkout SDK that can be embedded in any merchant website as a script tag. It must render a payment form in an iframe, handle cross-origin communication, support multiple payment methods (card, UPI, netbanking), and work across React, Vue, and plain HTML merchant sites.
Design the frontend architecture for a PayU checkout SDK that can be embedded in any merchant website as a script tag. It must render a payment form in an iframe, handle cross-origin communication, support multiple payment methods (card, UPI, netbanking), and work across React, Vue, and plain HTML merchant sites.
Explain idempotency keys in a payments API. What specific failure mode do they prevent, and how would you design the storage layer for them so they don't become a bottleneck?
Explain idempotency keys in a payments API. What specific failure mode do they prevent, and how would you design the storage layer for them so they don't become a bottleneck?
How would you design a feature that needs user location data for a core function, while minimizing what leaves the device and remains fully functional if the user denies location permission?
How would you design a feature that needs user location data for a core function, while minimizing what leaves the device and remains fully functional if the user denies location permission?
Explain the difference between role-based access control (RBAC) and attribute-based access control (ABAC). Give an example permission requirement that RBAC alone can't express cleanly.
Explain the difference between role-based access control (RBAC) and attribute-based access control (ABAC). Give an example permission requirement that RBAC alone can't express cleanly.
How would you design API key storage so that even if your database is breached, attackers can't use the leaked keys directly?
How would you design API key storage so that even if your database is breached, attackers can't use the leaked keys directly?