Security questions show whether you can be trusted with systems that handle money and personal data. Be ready to walk through OAuth flows and token validation, map OWASP risks to code, and design least-privilege identity for services.

You should also be ready to explain how you would protect your software supply chain.