Founding engineer backend interview questions

As asked

You are starting a B2B SaaS from zero. Walk me through every component of the authentication and authorization system you would build or buy, from email/password to SSO, including session management, token storage on the client, and how multi-tenancy fits in.

Sample answer outline

Strong answer evaluates build vs buy (Auth0, Clerk, Supabase Auth, NextAuth) honestly against team size. If building, covers bcrypt/Argon2 password hashing, short-lived JWTs with refresh tokens stored in httpOnly cookies, CSRF protection, and a roles table keyed on org+user. SSO via SAML or OIDC delegation rather than hand-rolling.

Expect these follow-ups

• A customer's security team asks whether you support SCIM provisioning. What is SCIM and how long does it take to add?
• How do you revoke a JWT before it expires?

As asked

Your product has a REST API consumed by your own web frontend and a mobile app you just shipped. A design partner wants to build an integration. How do you version the API, and what does your strategy look like when you have fifty integrators a year from now?

Sample answer outline

Candidate should distinguish internal vs external versioning concerns, explain URL path versioning trade-offs against header versioning, and discuss deprecation lifecycle. The real depth is in how they plan for breaking changes: additive changes are safe, field removal or semantic changes need a sunset window and communication plan.

Expect these follow-ups

• How do you communicate a breaking change to a design partner who has no SLA with you?
• What is the cheapest way to test that your v2 API does not break any v1 consumer before you deploy?

As asked

You need to send welcome emails, process webhook events, and run a nightly data export job. Your stack is Node.js and Postgres. Do you add Redis and a library like BullMQ, or do you use a Postgres-backed queue, or something else? Explain the trade-offs.

Sample answer outline

Candidate should evaluate operational complexity (Redis is another service to manage), durability (Postgres-backed queues like pg-boss survive restarts), and throughput requirements (Redis is faster). A strong answer picks Postgres-backed for early stage to reduce ops burden, knows when Redis becomes necessary (high concurrency, sub-second scheduling), and covers dead-letter queues, retry backoff, and idempotency.

Expect these follow-ups

• How do you ensure a job that failed halfway through does not send a duplicate email when it retries?
• Your nightly export job starts timing out at 3 AM. How do you investigate without waking up?

As asked

You are about to open your API to external developers. You need basic rate limiting before launch but you do not want to add Redis yet. What are your options, what are the trade-offs of each, and what do you actually ship?

Sample answer outline

Candidate should cover in-process sliding window (works only for single instance), database-backed counters in Postgres (adds latency per request, correct for multi-instance), and edge-layer rate limiting via a reverse proxy or CDN (Cloudflare, Nginx). A strong answer acknowledges that in-process is wrong for any multi-instance setup and picks the simplest correct solution for the current architecture.

Expect these follow-ups

• Your API is behind two load-balanced Node.js instances. Why does in-process rate limiting fail?
• A customer hits your rate limit but insists they were not sending that many requests. How do you investigate?

As asked

You need to show users real-time notifications (new messages, status updates) in a web app. Compare WebSockets, Server-Sent Events, and long-polling. Which do you actually implement for a team of two engineers launching in six weeks?

Sample answer outline

A strong answer evaluates SSE as simpler than WebSockets for one-directional server-to-client streams, correctly notes SSE works over HTTP/1.1 with connection limits but is solved by HTTP/2, and identifies that WebSockets are necessary only when the client also pushes data. For a founding-engineer context the answer should land on SSE or short-poll (5 seconds) as the pragmatic first cut, with WebSockets as a future optimization.

Expect these follow-ups

• SSE keeps a connection open. How does that interact with your load balancer?
• What happens to your real-time updates when the user's laptop goes to sleep and comes back?

As asked

Your Node.js Express API process memory climbs from 200 MB to 1.2 GB over 48 hours and then crashes. Walk me through exactly how you identify the leak, what tools you use, and what the three most common causes are in a typical Node.js API server.

Sample answer outline

Candidate should reach for --inspect and Chrome DevTools heap snapshots or clinic.js, explain the three-snapshot technique to find objects accumulating across GC cycles, and name the common culprits: closures capturing large request objects in event listeners, unbounded in-memory caches, and streams not being consumed or destroyed. Strong answers also cover how to reproduce the leak locally with autocannon or k6.

Expect these follow-ups

• How do you take a heap snapshot from a Node.js process that is already running in production without restarting it?
• Your leak is inside a dependency you do not own. What options do you have?

As asked

Your product sends webhooks to customer endpoints. Some customers have flaky servers. Walk me through how you design the delivery system so webhooks are reliably delivered, in order, and auditable, without building a full message broker.

Sample answer outline

Strong answer covers: persist the event to a webhook_events table before attempting delivery, use exponential backoff with jitter for retries, enforce a maximum retry window (24-48 hours), sign payloads with HMAC-SHA256 so customers can verify authenticity, expose a delivery log in the dashboard, and note that strict ordering across failures is hard and usually relaxed to at-least-once delivery.

Expect these follow-ups

• A customer says they are receiving duplicate webhooks. How do you help them handle idempotency on their end?
• Your webhook delivery worker goes down for four hours. What happens to pending deliveries when it restarts?

As asked

Your most expensive database query runs for every authenticated dashboard request, takes 800 ms, and returns results that are valid for five minutes per user. Design the caching layer, handling cache invalidation, cache stampedes, and the multi-region edge case.

Sample answer outline

Cache key should include the user ID and any filters to avoid cross-user data leakage. Redis with a 5-minute TTL is the first cut. Cache stampede prevention via a lock or probabilistic early revalidation. Invalidation: explicit delete on the mutations that change the data. Multi-region: a single Redis instance is a single point of failure and adds cross-region latency; candidate should know when to accept stale reads versus replicate the cache.

Expect these follow-ups

• What is a cache stampede and how does the probabilistic early revalidation technique (PER) prevent it?
• A bug caused wrong data to be cached. How do you flush the affected keys without flushing the entire cache?

As asked

A Node.js HTTP server handles 200 requests per second fine in benchmarks but real users occasionally see 10-second response times. You suspect event loop blocking. How do you confirm that, find the offending code, and fix it?

Sample answer outline

Candidate should explain that a single long-running synchronous operation blocks the event loop for all concurrent requests, demonstrate knowledge of event loop lag measurement (perf_hooks.monitorEventLoopDelay), and name typical offenders: synchronous JSON.parse on a large body, synchronous file read, a tight loop in a route handler. Fix: move CPU-heavy work to worker_threads, split work with setImmediate, or move to a queue.

Expect these follow-ups

• When would you use worker_threads versus a child process for CPU-heavy work?
• How does clustering help with event loop blocking, and where does it not help?

As asked

Your Next.js app stores the session in an httpOnly cookie and uses API routes for mutations. Walk me through why CSRF is a risk and exactly what you do to protect against it without breaking your mobile app that shares the same API.

Sample answer outline

CSRF is a risk because browsers automatically attach cookies to cross-origin requests. Defense options: SameSite=Strict (kills cross-site but breaks OAuth flows), SameSite=Lax (safe for most use cases), double-submit cookie pattern, or a custom header check (X-Requested-With) since simple cross-origin requests cannot set custom headers. The mobile app complication is that native apps use token-based auth (Bearer header), not cookies, so CSRF protection applies only to the browser surface.

Expect these follow-ups

• SameSite=Lax does not protect against top-level navigation POST requests. Give me an example attack.
• How does the double-submit cookie pattern work and what is its weakness?