Security defaults that belong in every Express application from day one.
93
90%
Does it follow best practices?
Impact
99%
6.18xAverage score across 5 eval scenarios
Passed
No known issues
A content team needs a REST API for their blogging platform. The API is built with Express and TypeScript. A Next.js frontend hosted on a different domain will consume it. The API will eventually run on a cloud VM behind a load balancer.
The API needs the following endpoints:
GET /api/posts -- list all published posts (supports ?page=1&sort=date query parameters)GET /api/posts/:slug -- get a single post by its URL slugPOST /api/posts -- create a new blog post (accepts title, content, tags array)PATCH /api/posts/:slug -- update an existing postDELETE /api/posts/:slug -- delete a postPOST /api/posts/:slug/comments -- add a comment to a post (accepts author and body)Use an in-memory array as the data store. Posts should have id, title, slug, content, tags, comments, published, and createdAt fields. Generate slugs from titles.
Produce:
app.ts -- Express application with all middleware and route setuproutes/posts.ts -- Router module with the blog post CRUD handlerspackage.json -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
express-security-basics
verifiers