Amazon·Software Engineer·Online Assessment (OA)·Intermediate

IntermediatePrefer not to say

Jun 2026Remote

Summary

Amazon SWE coding round where they handed me a broken repo and told me to fix it. No algorithm puzzle, just real debugging work on a password reset flow with multiple layers of issues stacked on top of each other. More stressful than a LeetCode problem honestly because the bugs weren't obvious at first glance.

Questions Asked (1)

You are given a partially broken codebase for a password reset flow. The flow has three steps: generate a verification code, verify it, then reset the password. Multiple bugs are present. Find and fix them.

Root Cause AnalysisAPI & IntegrationsTechnical Trade-offs

Author's notes

The first bug was almost embarrassing once I found it.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by understanding the intended flow and identifying the three steps. Then systematically trace the code to locate bugs, prioritizing security and correctness. Fix bugs one by one, explaining your reasoning and considering edge cases.

Pro tip: Demonstrate a security-first mindset by highlighting vulnerabilities like weak code generation or missing rate limiting, and suggest improvements beyond the immediate bugs.

1. Understand the Flow

Review the code to grasp the intended password reset process: generate code, verify code, reset password. Identify inputs, outputs, and state management.

2. Identify Bugs

Systematically trace each step to find bugs. Look for issues like incorrect code generation, missing validation, improper error handling, and security flaws.

3. Prioritize and Fix

Address bugs in order of severity, starting with security-critical ones. Explain each fix and ensure it doesn't introduce new issues.

4. Test and Validate

Mentally or verbally test the fixed flow with normal and edge cases (e.g., expired code, invalid input) to confirm correctness.

Key Points to Mention

Secure random code generation with sufficient entropy
Proper storage and expiration of verification codes
Input validation and sanitization to prevent injection attacks
Rate limiting to prevent brute-force attacks
Atomicity and consistency in password reset operations
Error handling that avoids information leakage

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.