Security defaults that belong in every Express application from day one.
93
90%
Does it follow best practices?
Impact
99%
6.18xAverage score across 5 eval scenarios
Passed
No known issues
A small team needs a REST API for their todo application. The API should be built with Express and TypeScript. It will be consumed by a React frontend running on a separate domain. The backend will be deployed behind an nginx reverse proxy.
The API needs the following endpoints:
GET /api/todos -- list all todosPOST /api/todos -- create a new todo (accepts JSON body with title and optional description)PATCH /api/todos/:id -- update a todo (toggle completed, edit title)DELETE /api/todos/:id -- delete a todoUse an in-memory array as the data store (no database required). Each todo should have id, title, description, completed, and createdAt fields.
Produce:
app.ts -- Express application with all middleware and route setuproutes/todos.ts -- Router module with the CRUD endpoint handlerspackage.json -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
express-security-basics
verifiers