Cheat Sheet
| Question | Core Idea | Senior Signal |
|---|---|---|
| Q236 | CSP | Roll out report-only first, govern script sources, and pair CSP with security headers. |
| Q237 | Storage | Avoid JavaScript-readable storage for high-value tokens; classify data before choosing storage. |
| Q238 | Auth UX | Enforce protected data server-side while keeping public shells fast and recovery states clear. |
| Q239-Q240 | Resilience | Retry safe reads, protect mutations with idempotency, and monitor security plus performance together. |