Express and Node API Security Review
Review middleware, routes and dependencies in an Express app.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Review this Node.js Express code for security. Paste app setup, middleware, routes and package scripts with secrets removed: [NODE_CODE]. Hosting and who uses the API: [HOSTING_USERS]. Authentication method: [AUTH_METHOD]. Check middleware order, security headers, body size limits, input validation, injection risks in queries and commands, error handlers that leak stack traces, session or token handling, and CORS configuration. Identify patterns that look safe but depend on code not shown. Return a table with Finding, Location, Severity (red, amber, green) and Fix, rewritten snippets for the top three issues, and a hardening checklist. Remind me to rotate any secret that appeared in pasted code. Also list the packages that deserve a version check, and the commands to run in a staging copy to see known advisories. Do not claim the system is secure. State what was and was not reviewed, list assumptions, and remind me that this review does not replace a penetration test or compliance audit by qualified people.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.