Question library
Explained questions for the decisions developers make.
How do you validate AI-generated code?
Validating AI-generated code means taking responsibility for its behavior rather than accepting plausible-looking output. Start from requirements and trace the important paths, then use tests and documentation to verify assumptions. Generated code deserves the same correctness, security and maintainability standards as manually written code.
How would you design a URL shortener?
A URL shortener maps a compact public code to a destination URL and redirects visitors efficiently. Creation needs unique-code handling, while redirects usually dominate the read workload. Caching can speed up redirects, but expiry, abuse controls and private links influence the cache and access rules.
Which HTTP status codes should I know?
An HTTP status code describes the outcome of an HTTP request using a standard numeric category. Clients use it to decide whether to use a result, correct a request, authenticate or retry. A response body can add application details, but should not contradict the status code.
How do I explain Azure AD SSO and its tokens?
Single sign-on lets an application rely on an identity provider so users can reuse an established login. OIDC supplies login identity on top of OAuth, while access and refresh tokens support API access and session continuation. The client and API validate different token purposes rather than trusting any token returned by the login service.
What is wrong with this example NestJS service?
The example performs a read, checks stock in application code, and later writes a modified value. Those steps are not one atomic operation, so another request can change the record between them. It also trusts the quantity without showing validation, making both business-rule and concurrency bugs possible.
LangChain agents versus simple code
LangChain agent construction combines models, tools, and runtime behavior into an agent interface. Simple code uses direct SDK calls and ordinary functions instead. Both can produce production applications if their reliability and security requirements are…
What is an execution context and call stack?
An execution context is the information JavaScript uses while running a piece of code, including its variables, scope and this value. The call stack tracks which function is currently running and where execution should return. Each function call adds a context, and returning removes it.
A deployment causes intermittent 500s. What do I check?
Intermittent failures after deployment often mean only some instances, requests or data shapes are incompatible with the change. A rolling deployment can briefly run old and new versions together. Grouping errors by instance and version reveals whether the issue is configuration, code, readiness or schema compatibility.
How do I check correctness?
Correctness means the implementation satisfies the required behavior for valid, invalid and concurrent inputs. A review begins with the intended rule, because readable or compilable code can still implement the wrong rule. Trace the inputs, state changes and outputs before judging style.
What can break in production, and how would I debug it?
Production failures often come from conditions absent in small examples: parallel requests, large datasets, expired credentials or unavailable providers. A review should consider how the code exposes and recovers from these conditions. Observability is part of the design because a hidden failure is harder to correct safely.
What are hoisting and the TDZ (Temporal Dead Zone)?
Hoisting is JavaScript's behavior of processing declarations before executing the code in a scope. Because of this, a function declaration can usually be called before its line appears, while variables behave differently depending on how they are declared.
How do I check security?
A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.
How do I check maintainability?
Maintainability means another developer can understand and safely change the code without discovering hidden dependencies. Clear responsibilities, names and contracts reduce the chance that a small change breaks unrelated behavior. Abstraction helps when it removes a real duplication or dependency, not merely when it adds more classes.
How can an atomic update prevent overselling?
A conditional atomic update makes the database check availability and reduce stock as one write operation. This avoids the application-level read/check/write gap. It protects the stock row, but related reservation records and repeated client submissions still need their own transaction and idempotency design.
What review comment would I leave?
A useful review comment explains an observable problem, its consequence and a concrete improvement. It should be specific enough to act on while leaving room for the author to discuss constraints. Focus on behavior and evidence rather than criticizing who wrote the code or whether AI generated it.
How do you maintain code quality?
Code quality is the ability of a codebase to remain correct, understandable and safe to change. It comes from clear design, meaningful tests, review and feedback from production behavior. Tools enforce some consistency, but they do not replace sound business rules or ownership of dependencies.
Python basics, lists, dictionaries, and sets
Python is a dynamically typed language widely used by AI libraries. A list is an ordered collection, a dictionary maps keys to values, and a set stores unique hashable values. Python uses indentation to define code blocks rather than braces.
Keyword search and BM25
Keyword search matches words or indexed terms rather than learned meaning. BM25 is a common relevance formula that rewards useful matching terms, accounts for document length, and avoids letting repeated words dominate indefinitely. It is usually implemented…
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.