{
  "context": "This criteria evaluates how effectively an engineer uses the koa-helmet package to apply unified security middleware to a Koa application. The focus is on proper usage of the helmet() function to set security headers with appropriate defaults.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "koa-helmet import",
      "description": "Correctly imports the koa-helmet package (e.g., `const helmet = require('koa-helmet')` or equivalent ES6 import)",
      "max_score": 10
    },
    {
      "name": "helmet() invocation",
      "description": "Calls the helmet() function to create the security middleware (with or without options)",
      "max_score": 30
    },
    {
      "name": "Middleware registration",
      "description": "Properly registers the helmet middleware with the Koa app using app.use()",
      "max_score": 25
    },
    {
      "name": "Middleware ordering",
      "description": "Applies helmet middleware before route handlers to ensure security headers are set for all routes",
      "max_score": 15
    },
    {
      "name": "Security headers present",
      "description": "The implementation results in appropriate security headers being set (e.g., X-Content-Type-Options, X-Frame-Options, etc.) through helmet's defaults",
      "max_score": 20
    }
  ]
}