Q277: Browser and Network Security Incident Response
What Interviewers Want To Evaluate
Interviewers want to know whether you can stay useful during a frontend security incident.
They are checking whether you can triage evidence, reduce blast radius, communicate clearly, preserve logs, and turn the incident into prevention.
Short Interview Answer
Frontend security incident response starts by confirming impact, preserving evidence, reducing blast radius, and communicating ownership. I identify affected routes, releases, users, browsers, dependencies, headers, storage, logs, and third-party scripts. Then I choose containment actions such as disabling a flag, rolling back, rotating exposed secrets, revoking sessions, tightening CSP, purging caches, or removing a compromised package. After recovery, I add regression tests, monitoring, and platform guardrails.
Detailed Interview Answer
Security incidents require calm structure.
The first goal is not to prove a theory.
The first goal is to reduce user harm while collecting enough evidence to make good decisions.
Frontend incidents can involve:
XSS
token exposure
wrong-user data
bad cache headers
compromised dependency
third-party script abuse
source map exposure
CORS misconfiguration
service worker stale code
private logs or replay leaks
Each incident needs a response path.
Triage Questions
Ask:
what changed?
when did it start?
which release?
which route?
which users?
which browser?
which geography?
which dependency or vendor?
what data may be exposed?
is the issue still active?
This narrows blast radius.
Avoid assuming the frontend is harmless because "the backend has auth."
Containment
Containment actions may include:
rollback deployment
disable feature flag
remove third-party script
tighten CSP
block a route
revoke sessions
rotate secrets
purge CDN cache
unregister service worker
disable upload type
Pick the action that reduces risk fastest with the least additional harm.
Evidence Preservation
Preserve:
release ID
bundle hashes
source maps
network headers
console errors
request IDs
CDN logs
error reports
dependency lockfile
CI logs
configuration history
Do not destroy evidence while trying to clean up.
But do remove active exposure quickly.
Communication
Good incident communication is specific:
current impact
affected systems
mitigation in progress
next update time
owner
open questions
user-facing impact
Avoid overclaiming certainty.
Say what is known, what is suspected, and what is being checked.
Example: Compromised Dependency
Response:
identify package version
check lockfile
check CI execution
check browser bundle inclusion
rotate exposed tokens if CI may be affected
pin or upgrade safe version
rebuild and redeploy
monitor errors
document exposure
This connects supply chain to runtime and CI.
Example: Bad Cache Leak
Response:
identify cached private response
purge CDN
fix Cache-Control
invalidate browser/service worker caches if possible
review Vary headers
check logs for affected users
add regression test
Caching incidents need both purge and prevention.
Example: XSS
Response:
disable vulnerable input or route
patch rendering or sanitization
tighten CSP if useful
rotate tokens if theft possible
review logs for suspicious actions
add payload regression tests
review similar surfaces
Do not treat CSP as the only fix.
Fix the injection point.
Recovery
Recovery means:
safe patch deployed
active exposure stopped
monitoring confirms stability
affected users identified
communication sent if needed
follow-up tasks created
owners assigned
Security recovery includes learning, not just green dashboards.
Common Mistakes
Common mistakes include:
debating root cause before containment
not rotating exposed secrets
not preserving release evidence
forgetting CDN or service worker caches
communicating vague status
not reviewing similar routes
not adding regression tests
not documenting decisions
Senior-Level Framing
The senior framing:
"During a frontend security incident, I separate containment, investigation, recovery, and prevention. I reduce active risk first, preserve evidence, communicate clearly, then turn root cause into tests and platform guardrails."
Practice Prompt
Create an incident response plan for:
public source map with secret
third-party script exfiltration
wrong user's progress shown
XSS in rendered markdown
compromised npm package
For each, list containment, investigation, recovery, and prevention.
Final Mental Model
Incidents punish vague ownership.
A senior frontend engineer brings structure: contain, investigate, recover, prevent, and communicate without drama.