A developer needs to reproduce a bug that only occurs with a specific customer's data. What do you allow?

What the interviewer is testing

Whether you can serve a legitimate engineering need without creating a standing data exposure.

What not to allow

Copying the customer's data into a development environment. That environment has weaker access control, broader access, longer retention, no clear purpose and no deletion path — and the copy will outlive the investigation.

The options, in order of preference

Reproduce from the shape, not the data. Identify what is unusual about the record — an unexpected null, a very long field, an unusual character, a state combination — and construct a synthetic record with the same property. This solves most cases and is what a good bug report should contain.

Debug in production with scoped, temporary access. Just-in-time elevation, time-bounded, tied to the ticket, session-logged, announced. The data stays where it is governed and the engineer sees only what they need.

Masked extract of the specific record, with identifiers and sensitive fields replaced while preserving the structural property that causes the bug. Approved case by case, logged, with a deletion deadline.

A production-like environment with a governed dataset — real access controls, audit logging, a defined retention period — for the cases that genuinely need production data. Not a development environment with a copy.

The control that makes this sustainable

A defined process rather than a case-by-case judgement under pressure. Engineers need a fast, legitimate route or they will find an informal one — and the informal route is a database export emailed to a laptop, which is far worse than any option above.

What a strong answer adds

Improving the diagnostic capability so the question arises less: better structured logging that captures the shape of the data without the content, error reporting that includes the failing field's type and length rather than its value, and the ability to replay a request with recorded context.

Most requests for production data are really requests for information about production data, and observability can supply that without the exposure.

Common weak answers

Refusing with no alternative, which produces informal workarounds. Granting a data copy with a promise to delete it.