Security defaults that belong in every Express application from day one.
93
90%
Does it follow best practices?
Impact
99%
6.18xAverage score across 5 eval scenarios
Passed
No known issues
A developer built a quick prototype Express API in a single file during a hackathon. The app works but needs to be restructured into a proper project layout before the team deploys it to production on AWS behind an Application Load Balancer. The React dashboard that consumes this API is hosted on a separate CloudFront distribution.
Your task is to refactor the provided single-file app into a clean, production-ready project structure with proper separation of concerns.
Produce:
app.ts -- Express application setup and middleware configurationroutes/inventory.ts -- Router module for inventory endpointsroutes/suppliers.ts -- Router module for supplier endpointspackage.json -- With all required dependenciesThe following file is provided as input. Refactor it into the output structure above.
=============== FILE: inputs/server.ts =============== import express from 'express';
const app = express(); app.use(express.json());
interface Item { id: number; name: string; sku: string; quantity: number; supplierId: number; }
interface Supplier { id: number; name: string; contact: string; }
const items: Item[] = [ { id: 1, name: 'Widget A', sku: 'WA-001', quantity: 150, supplierId: 1 }, { id: 2, name: 'Gadget B', sku: 'GB-002', quantity: 75, supplierId: 2 }, ];
const suppliers: Supplier[] = [ { id: 1, name: 'Acme Corp', contact: 'alice@acme.com' }, { id: 2, name: 'Globex Inc', contact: 'bob@globex.com' }, ];
let nextItemId = 3; let nextSupplierId = 3;
// Inventory endpoints app.get('/api/inventory', (req, res) => { res.json(items); });
app.post('/api/inventory', (req, res) => { const { name, sku, quantity, supplierId } = req.body; const item: Item = { id: nextItemId++, name, sku, quantity, supplierId }; items.push(item); res.status(201).json(item); });
app.patch('/api/inventory/:id', (req, res) => { const item = items.find(i => i.id === Number(req.params.id)); if (!item) return res.status(404).json({ error: 'Not found' }); Object.assign(item, req.body); res.json(item); });
app.delete('/api/inventory/:id', (req, res) => { const idx = items.findIndex(i => i.id === Number(req.params.id)); if (idx === -1) return res.status(404).json({ error: 'Not found' }); items.splice(idx, 1); res.json({ deleted: true }); });
// Supplier endpoints app.get('/api/suppliers', (req, res) => { res.json(suppliers); });
app.post('/api/suppliers', (req, res) => { const { name, contact } = req.body; const supplier: Supplier = { id: nextSupplierId++, name, contact }; suppliers.push(supplier); res.status(201).json(supplier); });
app.listen(3000, () => console.log('Running on 3000'));
evals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
express-security-basics
verifiers