Your question is Hardening Risky Token-Based Sessions. Take a moment with it on the right.
Talk me through your thinking if you like. When you're confident, submit your answer and I'll grade it like a real screen (7/10 or better passes).
Tell me about a time you identified a meaningful security risk in how session tokens or authentication were being used, and you had to drive changes across engineering teams to reduce that risk without slowing delivery too much. What was the situation, what tradeoffs did you make, and what happened in the end?