#api-security

Web Development

Secure-by-default Node.js APIs: the defaults we set before writing the first route

Grace Liu · Feb 12, 2026 · 6 min read

Most API vulnerabilities we find in reviews are missing defaults, not clever exploits: no body limits, validation on some routes, authorization in some handlers, stack traces in errors. The template we give teams starting a Node.js API, with the reasoning behind each default and code you can copy.

Web Development Bug Report

One nested GraphQL query pinned our API at 100% CPU: depth limits, cost analysis and introspection

Hannah Okafor · Nov 19, 2025 · 7 min read

A single GraphQL request with deeply nested author, posts and comments fields took 40 seconds and saturated every API pod, because the schema allowed unlimited depth and list sizes. The defensive controls we added: depth and complexity limits, page caps, persisted queries and an introspection policy.