Most API vulnerabilities we find in reviews are missing defaults, not clever exploits: no body limits, validation on some routes, authorization in some handlers, stack traces in errors. The template we give teams starting a Node.js API, with the reasoning behind each default and code you can copy.
Our partner OAuth server matched redirect_uri by prefix, and our login page followed any next URL. Chained together with a legacy implicit flow, an access token could land on an outside domain. We moved to exact matching, relative-only next and code plus PKCE.
After a harmless-looking Express refactor, every Stripe webhook failed verification and paid bookings stayed pending. A global JSON parser consumed the body before constructEvent saw it. How we found it, fixed the route and replayed the missed events.