← Whatnot Interview Insights

Whatnot·Software Engineer·Onsite - System Design / Architecture·Senior

SeniorPrefer not to say
May 2026

Summary

System design round at Whatnot for a software engineer role. The main question was the classic 'design LeetCode' problem, followed by two targeted follow-ups that got more interesting than the base question.

Questions Asked (3)

Q1

Design a platform like LeetCode, including its core features and architecture.

System DesignTechnical Trade-offs
Author's notes

Pretty well-trodden territory if you've done any system design prep.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and scale (e.g., number of users, submissions per day), then outline core features like problem browsing, code submission, and judging. Propose a high-level architecture with clear separation of concerns, and dive into 1-2 critical components (e.g., code execution sandbox, real-time submission processing) discussing trade-offs.

Pro tip: Emphasize security and isolation in the code execution environment, as it's the most challenging part; mention using containerization (Docker) with resource limits and network isolation, and discuss how to handle untrusted code safely.

1. Clarify Requirements and Scope

Ask questions to understand expected scale (users, submissions), core features (problem set, code editor, judge, contests), and non-functional requirements (latency, security, availability).

2. Define Core Features and User Flows

List essential features: problem browsing/search, code submission, real-time judging, user profiles, leaderboards, and contests. Describe the main user flow from problem selection to submission and feedback.

3. Design High-Level Architecture

Sketch a microservices-based architecture with components: API gateway, user service, problem service, submission service, judge service, and database. Explain data flow and interactions.

4. Deep Dive into Critical Components

Focus on the code execution sandbox: how to run untrusted code securely using containers, resource limits, and queuing. Discuss scalability of the judge service with message queues and worker pools.

5. Discuss Trade-offs and Scaling

Address trade-offs: SQL vs NoSQL for problems/submissions, synchronous vs asynchronous judging, caching strategies, and how to scale horizontally. Mention monitoring and fault tolerance.

Key Points to Mention

  • Security and isolation of code execution (sandboxing, containers, seccomp, resource limits)
  • Scalable and asynchronous submission processing using message queues (e.g., RabbitMQ, Kafka) and worker pools
  • Database design: relational for user/problem data, NoSQL or time-series for submissions and results
  • Caching strategies for problem statements and leaderboards (Redis, CDN)
  • Real-time feedback and WebSocket for live updates during contests
  • Trade-offs between consistency and availability in distributed judging

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q2

How do signed URLs work, and when would you use them in this system?

System DesignAPI & Integrations
Author's notes

This came as a follow-up and I fumbled it a bit.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by explaining the mechanics of signed URLs: a server generates a URL with a cryptographic signature that grants temporary access to a specific resource. Then, connect it to Whatnot's context by discussing use cases like live stream video delivery, user-uploaded images, or order invoices, emphasizing security and scalability benefits. Finally, outline when to use them—such as for direct client uploads/downloads—and mention trade-offs like expiration and revocation.

Pro tip: Mention that signed URLs offload traffic from your servers and reduce costs, but also highlight the importance of setting short expirations and using HTTPS to prevent leaks. This shows you consider both performance and security.

1. Define signed URLs

Explain that a signed URL contains a cryptographic signature (e.g., HMAC) and an expiration time, allowing temporary access to a private resource without requiring authentication credentials.

2. Explain how they work

Describe the process: the server generates a URL with a signature based on the resource path, expiration, and a secret key; the client uses it to access the resource directly from storage (e.g., S3, GCS).

3. Identify use cases at Whatnot

Discuss scenarios like serving live stream video segments to viewers, allowing sellers to upload product images directly to cloud storage, or providing temporary access to order invoices.

4. Discuss benefits and trade-offs

Highlight benefits: reduced server load, improved scalability, and enhanced security. Mention trade-offs: expiration management, inability to revoke easily, and potential for URL sharing.

5. Conclude with best practices

Summarize best practices: use short expirations, restrict by IP if possible, use HTTPS, and monitor for abuse. Tie back to system design goals like scalability and security.

Key Points to Mention

  • Cryptographic signing (e.g., HMAC-SHA256) with a secret key
  • Expiration time and scope (e.g., specific HTTP method, IP range)
  • Direct client-to-cloud storage uploads/downloads (e.g., S3 presigned URLs)
  • Reduced load on application servers and improved scalability
  • Security considerations: short-lived URLs, HTTPS, and revocation challenges
  • Use cases in live streaming, user-generated content, and e-commerce transactions

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.

Q3

How would you scale the system to support live competitions with many concurrent users?

System DesignTechnical Trade-offsData Modeling
Author's notes

The part I actually liked thinking about.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying the requirements and scale (e.g., number of concurrent users, expected latency, read/write patterns). Then propose a high-level architecture that addresses scalability, focusing on real-time communication, data consistency, and fault tolerance. Finally, dive into specific components and trade-offs, showing awareness of bottlenecks and mitigation strategies.

Pro tip: Emphasize the importance of load testing and gradual rollout to validate scalability assumptions, and mention how you would monitor key metrics like latency, error rates, and resource utilization in production.

1. Clarify Requirements and Scale

Ask questions to understand the expected number of concurrent users, peak load, latency requirements, and read/write ratio. This ensures your design targets the right scale and constraints.

2. High-Level Architecture

Outline a scalable architecture using load balancers, stateless services, and a pub/sub system for real-time updates. Consider using WebSockets or server-sent events for live interactions.

3. Data Storage and Consistency

Choose appropriate databases (e.g., NoSQL for scalability, SQL for transactions) and discuss sharding, replication, and caching. Address how to handle consistency for live scores and leaderboards.

4. Scalability and Fault Tolerance

Explain horizontal scaling of services, auto-scaling groups, and partitioning strategies. Discuss redundancy, failover, and graceful degradation to handle failures.

5. Monitoring and Iteration

Describe how you would monitor the system (metrics, logging, tracing) and use load testing to validate scalability. Mention iterative improvements based on real-world data.

Key Points to Mention

  • Use of WebSockets or long polling for real-time communication with clients.
  • Horizontal scaling of stateless services behind a load balancer.
  • Database sharding and replication to handle high write throughput.
  • Caching strategies (e.g., Redis) for frequently accessed data like leaderboards.
  • Message queues (e.g., Kafka) for decoupling and handling spikes in traffic.
  • CDN for static assets and edge caching to reduce latency.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.