Hardcoded API key leak
A security researcher reports that your shipped Android app binary contains a hardcoded backend API key with broad server-side privileges (it can read any user's records, not just the signed-in user's). They decompiled the APK to find it. Your API gateway logs show a spike of requests using that key from non-mobile user-agents and scripted patterns, enumerating user IDs sequentially. The key has been in every app release for ~8 months. You can't instantly force all users to update the app. How do you triage, contain, and remediate this embedded-secret leak?
What a strong answer looks like
Stop the bleeding first (mitigate), then form hypotheses from real signals. Separate root cause from symptom, communicate status as you go, and close with what prevents a repeat.
0:00 of about 35 min
Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.
Run or narrate your approach, then ask the coach.