Pergunta comum em entrevista de Security. A resposta abaixo está em inglês, do jeito que dá para falar numa entrevista: leia, feche e tente explicar com as suas palavras.
OWASP publishes security guidance and risk lists. Use the relevant threat model rather than treating a top-ten list as complete coverage.
SQL injection: bind data values with parameters. Raw queries inside an ORM can still be unsafe. Parameters do not substitute for identifiers or sort directions, so map those through a fixed allowlist.
XSS: use output encoding appropriate to its context and safe DOM APIs. If rich HTML is allowed, sanitize it with a maintained sanitizer. React escapes ordinary text rendering, but unsafe HTML, DOM APIs, and URL handling still need care. CSP is defense in depth, not a replacement for safe rendering.
CSRF: cookie credentials can accompany a request initiated from another site. Use applicable CSRF tokens, origin checks, and SameSite policy. Same-site is not the same as same-origin, and XSS can bypass many CSRF assumptions.
Also protect object-level authorization, rate-limit sensitive endpoints, avoid account-enumerating errors, and manage dependency vulnerabilities.
Sources: SQL injection prevention, XSS prevention, and CSRF prevention.
Ler é o primeiro passo. No app, essa pergunta vira flashcard com repetição espaçada, e o módulo tem quiz e simulado para testar o que ficou.
Treinar essa pergunta no app