1 min lesson
The two-minute shape
Take "The two-minute shape" step by step, then finish with the result that proves it worked.
Step 1 of 2
The two-minute shapeSTAR plus a ten-second reflection
- 1Situation · 20s. The system, the stakes and the trust boundary at risk. Fold the task in here and skip the backstory.
- 2Action · 60s, first person. What you did: the attacker reasoning, the design choice, the build. Say "I," not "we."
- 3Result · 30s, quantified. The outcome in numbers: vulns prevented, threat surface reduced, adoption rate, time-to-detect.
- 4Reflection · 10s. What you'd do differently or carried forward. This is where truth-seeking shows.
"Situation: our internal agent runner executed shell commands with the developer's own cloud credentials, and I could see one poisoned README turning that into an exfiltration path. Action: I wrote the proof of concept in an afternoon, then built a sandbox wrapper with deny-by-default egress and short-lived scoped credentials. I made it the CLI default so nobody had to opt in, and I paired with two teams through their first breakages. Result: in six weeks 90% of agent runs went through the sandbox, and the proof of concept stopped working. Reflection: I shipped without a break-glass path, an on-call engineer got blocked, and I added one the next day with an audit log. Now I ask who gets stuck before I ship a control."
Learn more
Advanced table
Final readiness checklist: score each axis 1 to 5
Final readiness checklist: score each axis 1 to 5Across all five rounds
- Axis
- Timed coding + security
- Ready: 4 to 5
- Solve medium-hard with a threat lens, narrate live
- Gap: 2 or below
- Stall on the code or miss the security overlay
- Axis
- Secure code review
- Ready: 4 to 5
- Catch the IDOR, the injection and the secret, rank them, fix the class
- Gap: 2 or below
- Miss a class or only patch the line
- Axis
- Threat modeling
- Ready: 4 to 5
- Boundaries first, JIT/least-privilege, friction tradeoff
- Gap: 2 or below
- Jump to controls, skip the boundaries
- Axis
- Agent security
- Ready: 4 to 5
- Name the boundary, use the lethal trifecta, contain instead of prompting
- Gap: 2 or below
- Reach for a guardrail prompt
- Axis
- Behavioral + why Cursor
- Ready: 4 to 5
- Three STAR stories under 2 min, product-grounded why
- Gap: 2 or below
- Stories ramble or why is generic
| Axis | Ready: 4 to 5 | Gap: 2 or below |
|---|---|---|
| Timed coding + security | Solve medium-hard with a threat lens, narrate live | Stall on the code or miss the security overlay |
| Secure code review | Catch the IDOR, the injection and the secret, rank them, fix the class | Miss a class or only patch the line |
| Threat modeling | Boundaries first, JIT/least-privilege, friction tradeoff | Jump to controls, skip the boundaries |
| Agent security | Name the boundary, use the lethal trifecta, contain instead of prompting | Reach for a guardrail prompt |
| Behavioral + why Cursor | Three STAR stories under 2 min, product-grounded why | Stories ramble or why is generic |
Grade yourself on the floor: spend your last hours on the lowest axis.
Interactive diagram. Tab through its regions; each focused region shows its detail in the panel below.
Treat every axis as blocking: grade yourself on your floor, so a sub-3 anywhere sinks the mock. The weights are a judgment call about where this role's edge is decided, not a list of axes you can skip.