It's interesting that you think working for a big tech company makes you especially qualified (or else you would not have mentioned it here). By working for a smaller company, you'd have to know these things or else face a world of pwnage.

> I feel like I have some homework to do.

Start with X-Frame-Options and HttpOnly cookies.