Question 1

What is AI hallucination?

Accepted Answer

When an AI model states something false with complete confidence, inventing a fact, a citation, a policy, or an API that does not exist. Hallucination is not a bug to be fully patched but a property of how language models work: they predict plausible text, not verified truth. It becomes a security and liability problem when that output is trusted, a chatbot inventing a refund policy (which Air Canada was held liable for in 2024), or an AI suggesting a package name that does not exist, which attackers then register with malware. The fix is to ground AI output in verified data and never treat it as authoritative on its own.

Question 2

What is Air gap?

Accepted Answer

Physically isolating a network or machine from the internet and every other network, so there is no cable or wireless path in or out. It is a strong control for critical systems like industrial controllers, but not a guarantee: anything a person carries across it (a USB drive, a laptop, a contractor’s machine) can carry malware too. Stuxnet famously crossed an air gap on a USB stick to reach Iran’s uranium centrifuges.

Question 3

What is APT?

Accepted Answer

A well-resourced attacker, usually a nation-state, that breaks in quietly and stays for the long haul, months or years, moving slowly to avoid detection while it steals data or pre-positions for sabotage. Unlike smash-and-grab criminals, an APT is patient, targeted, and willing to spend serious money and custom tooling on a single objective. The 2015 OPM breach, in which a China-linked group sat undetected for over a year and took 21.5 million US security-clearance records, is a textbook APT intrusion.

Question 4

What is Backdoor?

Accepted Answer

A hidden way into a system that bypasses normal authentication, planted deliberately by an attacker (or, occasionally, left by a careless developer). The danger of a backdoor is that everything looks normal: the system works, the login still asks for a password, but the attacker holds a secret key past it. Backdoors are the prize of supply-chain attacks, because one planted in widely used software, like the one nearly slipped into the xz compression library in 2024, would have handed an attacker quiet access to millions of servers.

Question 5

What is BootROM / SecureROM?

Accepted Answer

The very first code a chip runs when it powers on, also called the boot ROM or, on Apple devices, the SecureROM. It is burned permanently into the silicon at the factory, so no software update can change a single instruction of it, and it anchors the chain of trust: it cryptographically verifies the next boot stage, which verifies the next, all the way up to the operating system. A bug here is the most powerful and most permanent kind, because it sits below everything else and can never be patched on hardware already shipped; the only real fix is a new chip revision. The checkm8 (2019) and usbliter8 (2026) exploits both broke Apple SecureROM this way.

Question 6

What is Botnet?

Accepted Answer

A network of internet-connected devices, computers, servers, routers, cameras, that an attacker has quietly compromised and controls remotely, all at once, usually without the owners having any idea. Botnets are rented out to send spam, mine cryptocurrency, or, most visibly, fire huge floods of traffic in DDoS attacks. The 2016 Mirai botnet showed how dangerous they had become by enslaving hundreds of thousands of insecure IoT devices through default passwords their owners never changed.

Question 7

What is Buffer overflow / over-read?

Accepted Answer

A memory-safety bug where a program reads or writes past the end of a buffer, the fixed-size chunk of memory it was given. A write past the end (overflow) can corrupt memory and let an attacker run code; a read past the end (over-read) can leak whatever sensitive data sits next to it. These are the classic plague of languages like C and C++ that do not check memory bounds for you. Heartbleed was a famous over-read in OpenSSL that leaked private keys and passwords; the EternalBlue exploit behind WannaCry was an overflow.

Question 8

What is Build provenance?

Accepted Answer

A signed, machine-checkable record of how and where a software artifact was built: which source commit, which build system, which pipeline produced it. SLSA is the common framework for it, with levels describing how tamper-resistant the record is. It is a powerful integrity check, but the 2026 Miasma attack on Red Hat showed its limit: provenance proves a package was built by a given pipeline, not that the pipeline was clean. Subvert the build identity and the attestation will faithfully sign malware, so treat provenance as integrity, not trust.

Question 9

What is Call graph?

Accepted Answer

A model of which functions call which across your codebase. It is what lets a tool follow data from an untrusted input (a request parameter) to a dangerous sink (a database query or shell command) even when they live in different files. Stateward builds one as part of its whole-codebase knowledge base.

Question 10

What is Container escape?

Accepted Answer

Breaking out of a container to reach the host machine or other containers running on it. Containers share one operating-system kernel and only look isolated; they are a resource boundary, not a hard security boundary. A single kernel bug can erase that separation, letting code in one container read or corrupt another tenant or the host. This is the nightmare case for Kubernetes and multi-tenant cloud, where many untrusted workloads share a node. Copy Fail (CVE-2026-31431) is a container escape because the kernel page cache it corrupts is shared across every container on the host; real isolation needs a separate kernel, such as gVisor, Kata Containers or a microVM.

Question 11

What is Credential stuffing?

Accepted Answer

Taking username-and-password pairs leaked from one breach and trying them automatically, by the million, against other sites, betting that people reuse passwords. It is not a flaw in the target site’s code; it is the downstream cost of every previous breach plus password reuse, which is why MFA and breached-password checks matter so much. The 2023 23andMe breach was pure credential stuffing: no flaw in 23andMe, just reused passwords, which a data-sharing feature then turned into millions of exposed records.

Question 12

What is Cross-chain bridge?

Accepted Answer

A service that moves crypto assets between blockchains (say, from Ethereum to a cheaper chain), typically by locking the asset on one side and minting a copy on the other. Bridges are where the most money has been stolen in crypto, because they concentrate huge reserves and their security often rests on a small set of signers or a single verification step. Break that, as attackers did to Ronin (about $625 million) and Wormhole (about $325 million) in 2022, and the whole vault opens.

Question 13

What is Cryptojacking?

Accepted Answer

Hijacking someone else’s computers, servers, or cloud account to secretly mine cryptocurrency, stealing their compute and electricity for profit. Because it tries to stay quiet rather than destroy anything, cryptojacking is often the first visible sign of a deeper compromise: an attacker who can run a miner in your cloud can usually do far worse. Exposed dashboards, unsecured containers, and leaked cloud keys are the common entry points, as when attackers found an open Kubernetes console in Tesla’s cloud in 2018 and used it to mine.

Question 14

What is CVE?

Accepted Answer

A unique identifier for one publicly disclosed vulnerability in a specific product or library, for example CVE-2021-44228 (Log4Shell). CVEs are the lingua franca of vulnerability management, your SCA tool matches your dependencies against the CVE database.

Question 15

What is CVSS?

Accepted Answer

A 0–10 score for how severe a vulnerability is, based on exploitability and impact. Useful for ranking, but context-blind: a 9.8 in a package you do not reach matters less than a 6.5 on your auth path. Pair CVSS with reachability and exploitation status (KEV) to prioritize honestly.

Question 16

What is CWE?

Accepted Answer

A community catalogue of software weakness types, each with an identifier like CWE-89 (SQL injection) or CWE-79 (cross-site scripting). CWE classifies the kind of flaw; CVE identifies a specific vulnerable product. Findings mapped to CWE are easier to triage, dedupe and turn into compliance evidence.

Question 17

What is Data extortion?

Accepted Answer

Stealing an organisation’s data and threatening to publish it unless paid, with or without also encrypting the systems. "Double extortion" is when ransomware crews do both: encrypt for disruption and leak for pressure, so that good backups alone no longer save you. Some crews skip the encryption entirely and just steal and extort, as the Clop gang did when it mass-stole data from thousands of organisations through the MOVEit file-transfer flaw in 2023.

Question 18

What is DDoS?

Accepted Answer

An attack that knocks a service offline not by breaking in but by overwhelming it, flooding it with more traffic or requests than it can handle, usually from a botnet of thousands of machines at once (which is what makes it distributed, and hard to simply block by IP). DDoS targets availability rather than data. In 2016 the Mirai botnet aimed a record-breaking flood at the DNS provider Dyn and took much of the US internet, Twitter, Netflix, Reddit, offline for hours.

Question 19

What is DeFi?

Accepted Answer

Financial services, lending, trading, derivatives, built as smart contracts on a blockchain instead of through banks, with no intermediary and no one to call if it breaks. DeFi protocols hold billions in pooled funds governed entirely by code, which makes them a giant, permanent bug bounty: a single logic flaw can drain a protocol in one transaction. The recurring DeFi exploit classes are reentrancy, price-oracle manipulation, and flash-loan attacks.

Question 20

What is Dependency confusion?

Accepted Answer

Tricking a package manager into pulling a public package instead of your intended private one, by publishing a higher version number under the same name to a public registry. It lets an attacker inject code into internal builds; the fix is scoped registries and explicit source pinning.

Question 21

What is DMA attack?

Accepted Answer

Direct memory access (DMA) lets a hardware peripheral, like a USB or Thunderbolt controller, read and write system memory directly without going through the CPU, for speed. A DMA attack abuses that power: a malicious or buggy device writes to memory it should never touch, corrupting code or data to seize control. The defence is an IOMMU (Apple calls its version DART), a hardware gatekeeper that restricts which memory a peripheral can reach; leaving it disabled or in "bypass" mode removes the guard rail. The usbliter8 exploit walked a USB controller’s DMA write pointer backwards into protected memory precisely because the IOMMU was left in bypass mode.

Question 22

What is DORA?

Accepted Answer

An EU regulation for the financial sector covering ICT risk, third-party risk and operational resilience. Like NIS2 it demands demonstrable, continuous security posture rather than point-in-time audits, exactly the audit-ready evidence Stateward generates per pull request.

Question 23

What is EU Cyber Resilience Act?

Accepted Answer

An EU regulation setting cybersecurity requirements for products with digital elements across their lifecycle, including vulnerability handling and an SBOM. It pushes “secure by design” from best practice into law for products sold in the EU.

Question 24

What is False positive?

Accepted Answer

A finding a tool reports that is not actually exploitable in your context. High false-positive rates are the main reason teams ignore security tools. Stateward reduces them by validating findings against the real call graph and reachability, and by adversarially refuting candidates before reporting a verdict.

Question 25

What is Flash loan?

Accepted Answer

A loan of millions in crypto with no collateral and no credit check, on one condition: you borrow and repay it within a single blockchain transaction, or the whole thing is automatically undone as if it never happened. Flash loans are a legitimate DeFi tool, but they hand any attacker temporary access to enormous capital for free, which is then used to amplify a bug, manipulate a price oracle, or overwhelm a protocol’s math. Many of the largest DeFi exploits, including the 2023 Euler hack, were powered by flash loans.

Question 26

What is Hard fork?

Accepted Answer

A backwards-incompatible change to a blockchain’s rules that splits it in two: nodes that upgrade follow the new chain, those that do not keep the old one, and both can survive as separate coins. Hard forks are how a community changes the rules, or undoes a disaster. After the 2016 DAO hack drained a third of a $150 million fund, Ethereum hard-forked to reverse the theft, and the minority who objected on "code is law" principle kept the original chain alive as Ethereum Classic.

Question 27

What is Hot wallet vs cold storage?

Accepted Answer

A hot wallet keeps its private keys on an internet-connected system so funds can move quickly, which an exchange needs for withdrawals, and which is exactly the first thing an attacker who breaches it goes for. Cold storage keeps keys offline, out of an attacker’s reach. The standard defence is to hold the vast majority of funds in cold storage and size the hot wallet only to daily operational need, so a breach drains a survivable amount rather than everything.

Question 28

What is ICS / SCADA?

Accepted Answer

The computers and controllers that run physical processes: power grids, pipelines, water treatment, factories. SCADA is the supervisory software operators watch; PLCs (programmable logic controllers) are the small ruggedised computers that actually open valves and spin motors. They were built for reliability and uptime, not security, and often run for decades without patches, which is why an attacker who reaches them can cause real, physical damage. Defending them is its own discipline, OT (operational-technology) security.

Question 29

What is IDOR?

Accepted Answer

Exposing a reference to an internal object, a database id in a URL, without checking that the current user is allowed to access it, so changing /invoice/123 to /invoice/124 leaks someone else’s data. It is a form of broken access control, the top OWASP risk, and authorization must be checked server-side on every request.

Question 30

What is Infostealer?

Accepted Answer

Malware that quietly harvests everything useful on an infected machine, saved browser passwords, session cookies, autofill data, and crypto wallets, and ships it to the attacker. Infostealers have become the engine of modern breaches: a single infected laptop, often a personal one, leaks corporate credentials that are then sold on criminal markets and used to log in to company systems. The 2024 Snowflake attacks, which hit dozens of major companies, were powered by credentials taken from infostealer-infected machines where MFA was not enforced.

Question 31

What is Integer overflow / wraparound?

Accepted Answer

Arithmetic that produces a value larger than a fixed-size integer can hold, so instead of erroring it silently wraps around to a small or wrong number. A close cousin is a bounds check written against the wrong limit, which lets an overflowing value slip through. In financial or DeFi math this is devastating: an attacker can make a contract believe a near-zero deposit is worth an enormous amount, then withdraw real funds. The bug often hides in a shared math library, so a single wrong constant can drain many protocols at once. The $223M Cetus hack on Sui came from exactly this: a faulty overflow check in the shared integer-mate library credited a one-token deposit as astronomically large liquidity.

Question 32

What is Jailbreak?

Accepted Answer

Removing the software restrictions Apple builds into iOS so a device can run unsigned code and software Apple has not approved. It is done by chaining exploits that defeat the chain of trust, from the boot loader up. A jailbreak rooted in a BootROM exploit is "tethered" or "semi-tethered": because the underlying bug is in unchangeable silicon it cannot be made permanent, so the exploit must be re-run over USB on every reboot. That same low-level access also underpins iPhone forensic-extraction tools. checkm8 powered the checkra1n jailbreak on older devices; usbliter8 opens the same door on the A12 and A13.

Question 33

What is KEV?

Accepted Answer

CISA’s authoritative list of vulnerabilities that are being actively exploited in the wild. A KEV entry means attackers are using it right now, so it jumps the patch queue regardless of its CVSS score. Stateward’s live feed surfaces KEV entries the moment they land.

Question 34

What is Lateral movement?

Accepted Answer

What an attacker does after the first foothold: moving from the machine or account they initially compromised toward the data or systems they actually want, using stolen credentials, unpatched internal services, or over-broad permissions. Most breaches are not one clever exploit but a chain of small hops across a flat, over-trusting network. It is why segmentation and least privilege matter so much: they turn a single foothold into a dead end instead of a master key. In the 2013 Target breach, attackers hopped from an HVAC vendor’s access all the way to the checkout registers.

Question 35

What is Logic & correctness bug?

Accepted Answer

A bug where the code runs but does the wrong thing, not an attacker-facing hole, but an honest mistake a careful engineer makes. Integer IDs approaching their type’s limit at scale, money handled in floating point (0.1 + 0.2 ≠ 0.3), off-by-one boundaries, broken invariants, unhandled edge cases. Rarely exploitable, but a leading cause of outages, data corruption and costly incidents, the reason the security-audit industry exists. Stateward’s adversarial deep audit hunts these by reasoning about what each function must guarantee and trying to break it, not by pattern-matching known CVEs.

Question 36

What is Merge-induced vulnerability?

Accepted Answer

A flaw that exists in neither branch alone but appears once two branches are merged, for example one branch removes a validation that another branch starts depending on. Diff-only scanners miss it because each diff looks safe. Stateward analyses the merged result against the whole codebase, which is where it surfaces.

Question 37

What is MFA?

Accepted Answer

Requiring more than a password to log in, by adding a second factor: a code, an app prompt, or ideally a hardware key. MFA is the single highest-value control against stolen or guessed passwords, because the password alone is no longer enough. But not all MFA is equal: SMS codes and simple app prompts can be phished or worn down (see MFA fatigue), while phishing-resistant factors like FIDO2/WebAuthn passkeys cannot. The 2021 Colonial Pipeline shutdown began with one VPN account that had no MFA at all.

Question 38

What is MFA fatigue?

Accepted Answer

An attack that abuses push-based multi-factor authentication. After stealing a valid password, the attacker triggers a flood of MFA approval prompts (also called push bombing) until a tired or confused user finally taps "Approve", often helped along by the attacker impersonating IT over a call, SMS or WhatsApp. It defeats MFA without breaking any cryptography. The defence is phishing-resistant, hardware-backed MFA (FIDO2/WebAuthn passkeys), number-matching, and capping repeated prompts; the rule of thumb for users is that real IT never asks you to approve a login you did not start. It is how attackers breached Uber in 2022.

Question 39

What is MSP?

Accepted Answer

A company you outsource your IT to: it manages your servers, patches your software, and runs remote-management (RMM) tools that reach deep into your network with high privilege. That reach is the risk. Compromise one MSP, or the tool it uses, and you compromise every customer at once. The 2021 Kaseya attack did exactly that, pushing ransomware through MSPs to roughly 1,500 of their downstream businesses in a single stroke.

Question 40

What is Multisig?

Accepted Answer

A wallet or contract that requires several independent keys to approve a transaction (say 3 of 5), so no single stolen key can move the funds. It is a strong control when the keys are genuinely held by different people and systems, and when the policy is enforced where a client cannot bypass it. It fails when too many keys end up in one place: in the 2022 Ronin hack the attacker obtained five of the nine validator keys and emptied the bridge.

Question 41

What is NIS2?

Accepted Answer

An EU directive (2022) that broadens cybersecurity obligations across essential and important entities, with requirements for risk management, supply-chain security and incident reporting. It raises the bar for software security evidence; Stateward maps findings to it and keeps data EU-hosted with EU data residency.

Question 42

What is OWASP Top 10?

Accepted Answer

The Open Worldwide Application Security Project’s ranked list of the ten most critical web application risks, broken access control, injection, cryptographic failures and so on. It is the default checklist auditors and frameworks reference; Stateward maps each finding to its OWASP category.

Question 43

What is Page cache?

Accepted Answer

The pool of memory the operating-system kernel uses to keep recently-used file contents in RAM, so programs do not have to read the disk every time. When you run a program, the CPU executes the bytes from its cached pages, not from a fresh disk read. That makes the page cache a high-value target: corrupting the cached copy of an executable changes what it does the next time it runs, while the file on disk stays untouched, so disk-based integrity scanners see nothing. A whole family of Linux privilege-escalation bugs (Dirty COW, Dirty Pipe, and Copy Fail) works by sneaking a write into page-cache pages that should have been read-only.

Question 44

What is Password spraying?

Accepted Answer

A login attack that flips brute-forcing around: instead of trying many passwords against one account (which triggers lockouts), the attacker tries one or two very common passwords against many accounts. Low and slow, it stays under rate limits and lockout thresholds, and it only takes one person using "Winter2024!" to get in. It works against any account without MFA. In 2024 Russia’s SVR used password spraying to breach a forgotten test account at Microsoft and pivot into senior executives’ email.

Question 45

What is Phishing?

Accepted Answer

Tricking a person into handing over credentials, money, or access by impersonating someone they trust, usually over email but also by text (smishing), phone (vishing), or a fake login page. It is the most common first step in a breach because it targets people, not code: no software flaw is needed if someone can be convinced to type their password into the wrong box. Targeted versions aimed at a specific person, spear phishing, are how many famous intrusions began.

Question 46

What is Private key?

Accepted Answer

The secret number that controls a cryptocurrency wallet or account. Whoever holds the private key can move the funds, full stop: there is no bank to call and no password reset. This makes key management the whole game in crypto security, and most large crypto thefts are not clever contract math but a stolen or mis-signed private key. The 2025 Bybit theft, the largest in history at about $1.5 billion, was at root a signing compromise.

Question 47

What is Privilege escalation?

Accepted Answer

Gaining more permission than you are supposed to have. Vertical escalation means jumping from a normal user to an administrator or, on Linux, to root (UID 0); horizontal escalation means taking over another account at the same level. A local privilege escalation (LPE) starts from any foothold on a machine, even an unprivileged shell, and ends at full control, which is why it is so dangerous on shared systems where untrusted code already runs, like CI runners, multi-tenant servers and Kubernetes nodes. The Copy Fail kernel bug (CVE-2026-31431) is a textbook LPE: an ordinary user becomes root with a tiny script.

Question 48

What is Prompt injection?

Accepted Answer

Manipulating an LLM-powered application by smuggling instructions into its input, directly, or indirectly through content the model later reads (a web page, a document, a tool result). It is the defining vulnerability class of AI applications and has no single clean fix; you contain it with least privilege, output validation and human approval for sensitive actions.

Question 49

What is Ransomware?

Accepted Answer

Malware that encrypts a victim’s files or whole systems and demands payment, usually in cryptocurrency, for the key to unlock them. Modern crews also steal the data first and threaten to leak it (double extortion), so paying does not even guarantee privacy. The defences that actually work are tested offline backups, fast patching, MFA, and segmentation so one infected machine cannot reach everything.

Question 50

What is RCE?

Accepted Answer

A vulnerability that lets an attacker run arbitrary code on your server or a user’s machine, the most severe outcome, because it usually means full compromise. It often arrives through unsafe deserialization, command injection or a vulnerable dependency like Log4Shell.

Question 51

What is Reachability analysis?

Accepted Answer

Determining whether a vulnerable function in a dependency is actually called by your code. A CVE in a package you import but never exercise on a vulnerable path is far lower priority. Reachability cuts dependency noise dramatically by separating “present” from “exploitable.”

Question 52

What is Reentrancy?

Accepted Answer

A smart-contract bug where a function sends funds to an external address before it updates its own bookkeeping, and the receiving contract calls back in to withdraw again, and again, before the balance is ever decremented, so the contract pays out many times for one withdrawal. It is the oldest and most famous class of DeFi exploit, the 2016 DAO hack was a reentrancy attack, and it still drains protocols today. The fix is the "checks-effects-interactions" pattern: update your state before making external calls.

Question 53

What is Remote access trojan?

Accepted Answer

Malware that gives an attacker hands-on remote control of an infected machine: running commands, reading and writing files, and pulling down further payloads, usually while beaconing quietly to a command-and-control server. Unlike a one-shot stealer, a RAT is an open door the attacker keeps using. The 2026 axios compromise dropped a cross-platform RAT (WAVESHAPER.V2) onto any machine that installed the poisoned versions, with native variants for Windows, macOS and Linux.

Question 54

What is Rootkit?

Accepted Answer

Malware that hides itself, and other malicious activity, from the operating system and from defenders by hooking deep into the system (the kernel, drivers, or firmware), so the files, processes, and connections it controls become invisible to normal tools. Because it tampers with the very system you would use to inspect it, a rootkit-infected machine cannot be trusted to report its own state; the only safe response is to rebuild from known-good media. Stuxnet carried both a Windows rootkit and the first known rootkit for industrial controllers.

Question 55

What is SAST?

Accepted Answer

Analysis of source code, without running it, to find security flaws like injection, broken access control or unsafe deserialization. Classic SAST works on a single file or diff; Stateward reasons over the whole codebase, its call graph and trust boundaries, so it catches flaws that only appear across files or branches.

Question 56

What is SBOM?

Accepted Answer

A machine-readable inventory of every component and dependency in a piece of software, including transitive ones. Regulations like the US Executive Order 14028 and the EU Cyber Resilience Act increasingly require one, because you cannot defend a supply chain you cannot enumerate.

Question 57

What is SCA?

Accepted Answer

Inventorying your open-source dependencies and matching them against known vulnerabilities (CVEs), license risk and maintainer risk. Good SCA matches the exact installed version and tells you whether the vulnerable code is actually reachable, instead of alerting on every transitive package.

Question 58

What is Secret scanning?

Accepted Answer

Detecting credentials, API keys, tokens, private keys, database URLs, committed into source control. The fix is never just deleting the line: a leaked secret in git history is compromised and must be rotated. Stateward scans every diff at the commit, before the secret reaches a shared branch.

Question 59

What is Secrets?

Accepted Answer

The passwords of machines: API keys, access tokens, database credentials, and signing keys that let code authenticate to other systems. Secrets are dangerous precisely because they are reusable and portable, one leaked token can open everything it was authorized for. They leak constantly, hardcoded in source, committed to git, printed in logs, or exposed in CI environment variables, which is exactly what the 2021 Codecov attack harvested from thousands of pipelines. The defences are to keep secrets out of code, scan for them continuously, and rotate them fast when exposed.

Question 60

What is Session hijacking?

Accepted Answer

Stealing the token or cookie that proves a user is already logged in, and replaying it to take over their session without ever needing their password or MFA. Because the token represents an already-authenticated session, it sidesteps login defences entirely, which is why stealing session cookies, through malware, a support-file upload, or a malicious script, is such a prized technique. The 2023 Okta support breach worked this way: attackers lifted session tokens from files customers had uploaded and used them to walk into those customers’ accounts.

Question 61

What is Smart contract?

Accepted Answer

A program that runs on a blockchain and controls funds or assets directly: code that executes automatically and irreversibly when its conditions are met. Its power and its danger are the same thing, because once deployed it usually cannot be patched, and a bug is not a crash but a vault anyone can drain. Most large DeFi thefts are simply exploited smart-contract logic. The 2016 DAO hack, where a flaw let an attacker siphon a third of a $150 million fund, was the first to prove the stakes.

Question 62

What is Social engineering?

Accepted Answer

Manipulating people rather than machines to get in: convincing a help desk to reset a password, an employee to approve a login, or a contractor to run a "fix." Phishing is one kind of social engineering; others include impersonating IT on a call, building fake trust over weeks, or simply asking with enough confidence. It works because it sidesteps every technical control, which is why the strongest defences pair good technology with trained, skeptical people.

Question 63

What is Source map exposure?

Accepted Answer

Shipping a JavaScript source map (.map) to production, or inside a published package, so anyone can download your original source. Bundlers embed the full code in the map’s sourcesContent field, so an exposed map leaks unminified code, internal comments, hidden API endpoints and any compiled-in secrets, Apple’s App Store front-end and Anthropic’s Claude Code both shipped one by accident. Stateward detects it (CWE-540) in the pull request: a committed .map artifact, a sourceMappingURL left in a shipped bundle, or a build config that emits production maps (Vite, webpack, Next.js, Create React App, Vue, Rollup), so it never reaches production.

Question 64

What is SQL injection?

Accepted Answer

Inserting attacker-controlled input into a database query so it changes the query’s meaning, letting an attacker read, modify or destroy data. The fix is parameterized queries (bound parameters), never string concatenation. It is CWE-89 and a perennial OWASP Top 10 entry.

Security terms, in plain language

See these flaws caught on a real pull request