Portfolio ↗

Quiz

2988 questions of the kind that actually get asked — in interviews, in architecture review boards, and by the person who has to run the thing at 3 AM. Every answer states the trade-off rather than the slogan, and says when the obvious choice is the wrong one.

All areas2988 Architecture Fundamentals91 Distributed Systems111 Data Architecture100 Cloud Architecture97 Networking96 API & Integration Architecture97 Reliability & Resilience99 Observability92 Performance & Capacity Engineering100 Security Architecture105 Cost Architecture & FinOps102 Business Architecture103 Architecture Communication102 Enterprise Architecture100 Legacy Modernization102 AI-Era Architecture106 Software Architecture & Engineering93 Architecture Patterns94 Architecture Decision-Making101 The Architect's Meta-Skills102 Delivery & Release Engineering103 Platform Engineering & Developer Experience102 Testing & Quality Architecture102 Data Platform Architecture98 Streaming & Real-Time Data103 Data Governance & Semantics91 Frontend & Experience Architecture101 Edge, Mobile & IoT98 Regulatory & Data Protection Architecture99 Assurance, Audit & Model Risk98
Difficulty Any beginner intermediate advanced

5 questions in Pipeline Secrets.

  1. Pipeline Secrets intermediate

    A build pipeline needs credentials to deploy. What is the safe design, and what is the most common leak?

    2 min answer supabasesecretspipelineworkload-identity
  2. Pipeline Secrets beginner

    A build script echoes a deployment token into the pipeline log. The log is private to the engineering team. Is the token compromised?

    2 min answer secretsci-cdrotationblast-radius
  3. Pipeline Secrets advanced

    A team stores no credentials in its repository. The cloud role is assumed through OIDC federation, the registry token lives in a managed secret store, and the build never prints it. Over one weekend an attacker publishes a malicious version of the team's package, and the audit trail shows the push came from the team's own pipeline. Trace how, and name the structural fix.

    3 min answer pipeline-secretsfork-triggeroidcsupply-chain
  4. Pipeline Secrets advanced

    Between 31 January and 1 April 2021 an altered Codecov Bash Uploader script exfiltrated the environment variables of every CI job that ran it, and was discovered by a customer comparing the script's checksum against the published one. What is the underlying architectural failure, and which changes remove the class rather than the instance?

    3 min answer codecovci-secretssupply-chainoidc
  5. Pipeline Secrets advanced

    How should secrets be handled in a delivery pipeline, and what is the strongest available approach?

    2 min answer secretsworkload-identityscopingexfiltration