Security defaults that belong in every Express application from day one.
93
90%
Does it follow best practices?
Impact
99%
6.18xAverage score across 5 eval scenarios
Passed
No known issues
An e-commerce company needs a REST API for their order management system. The API is built with Express and TypeScript. A Vue.js storefront on a separate domain will call this API. The service runs behind a single nginx proxy in their data center.
The API needs the following endpoints:
GET /api/products -- list all productsGET /api/products/:id -- get a single productPOST /api/orders -- place a new order (accepts items array with productId and quantity, plus customerEmail)GET /api/orders/:id -- get order detailsGET /api/orders -- list orders (supports ?status=pending filter)Use in-memory arrays for products and orders. Products should have id, name, price, and stock fields. Orders should have id, items, customerEmail, total, status, and createdAt. When an order is placed, validate that products exist and have sufficient stock, then decrement stock accordingly.
Produce:
app.ts -- Express application with all middleware and route setuproutes/products.ts -- Router module for product endpointsroutes/orders.ts -- Router module for order endpointspackage.json -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
express-security-basics
verifiers