Before you can secure a web application you need a list of everything an attacker can touch. A practical method to map inputs, authentication, sessions, file handling, APIs, admin paths and third parties, with the control each area needs.
Most API vulnerabilities we find in reviews are missing defaults, not clever exploits: no body limits, validation on some routes, authorization in some handlers, stack traces in errors. The template we give teams starting a Node.js API, with the reasoning behind each default and code you can copy.
The pre-launch security checklist we run on every new web app, organised by the OWASP Top 10:2025 categories: authorization tests, injection, secrets, headers and CSP, supply chain, error handling and logging, each with a concrete check you can automate.