Question library
Explained questions for the decisions developers make.
How do I check correctness?
Correctness means the implementation satisfies the required behavior for valid, invalid and concurrent inputs. A review begins with the intended rule, because readable or compilable code can still implement the wrong rule. Trace the inputs, state changes and outputs before judging style.
How do I check security?
A security review checks whether code respects boundaries between untrusted input, authenticated identity and protected actions or data. It asks what a caller can control and whether that control lets them exceed their permissions. Framework defaults and type annotations do not establish resource-level access automatically.
How do I check performance?
A performance review checks whether the amount of work stays reasonable as input size and traffic increase. Database calls, large allocations and synchronous CPU work can be more important than small syntax choices. Use measurements for suspected hotspots rather than adding optimizations everywhere.
How do I check reliability?
Reliability means the operation behaves predictably when dependencies fail, time out or return uncertain outcomes. It includes recovery after a crash, bounded resource use and preservation of business state. A happy-path test cannot prove that retries, rollback and cleanup are correct.
How do I check maintainability?
Maintainability means another developer can understand and safely change the code without discovering hidden dependencies. Clear responsibilities, names and contracts reduce the chance that a small change breaks unrelated behavior. Abstraction helps when it removes a real duplication or dependency, not merely when it adds more classes.
Which edge cases and tests matter most?
Edge cases are valid boundary conditions and failure situations that ordinary examples may not exercise. Useful tests prove important rules under those conditions, including concurrent and repeated requests. The highest-value case is often where a missing record, denied access or partial failure changes control flow.
What can break in production, and how would I debug it?
Production failures often come from conditions absent in small examples: parallel requests, large datasets, expired credentials or unavailable providers. A review should consider how the code exposes and recovers from these conditions. Observability is part of the design because a hidden failure is harder to correct safely.
What is wrong with this example NestJS service?
The example performs a read, checks stock in application code, and later writes a modified value. Those steps are not one atomic operation, so another request can change the record between them. It also trusts the quantity without showing validation, making both business-rule and concurrency bugs possible.
How can an atomic update prevent overselling?
A conditional atomic update makes the database check availability and reduce stock as one write operation. This avoids the application-level read/check/write gap. It protects the stock row, but related reservation records and repeated client submissions still need their own transaction and idempotency design.
What review comment would I leave?
A useful review comment explains an observable problem, its consequence and a concrete improvement. It should be specific enough to act on while leaving room for the author to discuss constraints. Focus on behavior and evidence rather than criticizing who wrote the code or whether AI generated it.
How do I spot common React and async bugs?
React and async bugs often come from incorrect assumptions about identity, snapshots and completion order. A render's values can be captured by a callback, and asynchronous results may arrive after the UI has moved on. Review the lifecycle and timeline rather than checking syntax alone.
Explain your most difficult project.
A difficult-project answer should focus on one concrete challenge and how you handled it. The interviewer is assessing problem solving, ownership and learning more than the project's impressive name. Use real constraints and evidence so the explanation remains defensible under follow-up questions.
Tell me about a production issue.
A production-incident answer explains impact, investigation, mitigation and prevention in a clear order. It should show that you worked from evidence and reduced risk while users were affected. Use a genuine incident and avoid claiming a root cause you never confirmed.
Tell me about a technical disagreement.
A technical-disagreement answer shows how you compared competing priorities and reached a workable decision with others. The goal is to explain reasoning and collaboration, not prove that you won an argument. Use an example where evidence, constraints or a small experiment helped the team choose.
Tell me about a decision you changed later.
Changing a technical decision can show good judgment when new evidence invalidates an earlier assumption. Explain why the original choice was reasonable at the time and what information changed. Then describe how you migrated safely rather than simply declaring the first choice bad.
How do you validate AI-generated code?
Validating AI-generated code means taking responsibility for its behavior rather than accepting plausible-looking output. Start from requirements and trace the important paths, then use tests and documentation to verify assumptions. Generated code deserves the same correctness, security and maintainability standards as manually written code.
How do you maintain code quality?
Code quality is the ability of a codebase to remain correct, understandable and safe to change. It comes from clear design, meaningful tests, review and feedback from production behavior. Tools enforce some consistency, but they do not replace sound business rules or ownership of dependencies.
How do you remove duplicate IDs from an array?
Deduplication removes repeated values according to a defined equality rule. JavaScript Set handles primitive IDs conveniently and keeps the order of first insertion. Objects are compared by reference, so deduplicating records by an id field requires an explicit key-based approach.
Difficulty is an editorial estimate. Completion means you chose to mark a question as understood.