Security defaults that belong in every Express application from day one.
93
90%
Does it follow best practices?
Impact
99%
6.18xAverage score across 5 eval scenarios
Passed
No known issues
A startup needs a user authentication API built with Express and TypeScript. The API will handle user signup and login using JWT tokens. A React single-page app on a separate domain will consume this API.
The API needs the following endpoints:
POST /api/auth/register -- create a new user account (accepts email, username, password)POST /api/auth/login -- authenticate and return a JWT tokenGET /api/auth/me -- return the current user's profile (requires valid JWT in Authorization header)Use bcrypt for password hashing and jsonwebtoken for JWT creation/verification. Store users in an in-memory array (no database required). The JWT secret should come from an environment variable.
Produce:
app.ts -- Express application entry point with middleware and route wiringroutes/auth.ts -- Router module with register, login, and profile endpointsmiddleware/authenticate.ts -- JWT verification middleware for protected routespackage.json -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
express-security-basics
verifiers