Express Security Scan

Defensive scan for Express.js (4.x / 5.x) applications. Reports findings using the shared scoring schema.

Scope

• Files importing express, express.Router, or registering middleware on an app
• Session / cookie / CSRF middleware setup
• Route handlers under routes/, controllers/, api/

Procedure

1. Find the app = express() initializer and follow app.use(...) calls in order — middleware order matters.
2. For each route handler, trace req.body/req.params/req.query into sinks.
3. Apply the rules below.

Rules