Security Interview Questions

First treat the key as leaked: rotate it in the provider dashboard, because NEXT_PUBLIC_ values are inlined into the JavaScript bundle at build time. Then move the model call into a Route Handler, store the key in a variable without the NEXT_PUBLIC_ prefix, and import "server-only" in the module that uses it so a Client Component import fails the build. The browser only talks to your route, which adds auth and limits before calling the provider.

Use dangerouslySetInnerHTML to render HTML strings from a CMS or API, and always sanitize external content with DOMPurify to prevent XSS.

React auto-escapes output to prevent XSS, but dangerouslySetInnerHTML, eval, and third-party content require explicit sanitization. Use HttpOnly cookies for JWTs, validate input on both sides, add CSP headers, and audit dependencies regularly.