A wildcard CORS header only controls who can read a response in a browser, not who can call your API, and that distinction is exactly where "unblocked for local dev" configs turn into production data leaks.
Building a filename or hostname into a child_process.exec() string hands a shell to whoever controls that input. Here's the realistic exploit and the execFile/spawn fix.
A "dynamic formula" or "custom rule" feature is how eval() sneaks into production. Here's exactly what it exposes once user-influenced input reaches it, and the parser or allow-list pattern that closes the hole.
SQL injection should be a solved problem, but AI coding assistants keep generating the vulnerable concatenated-string version by default because it looks like it works. Here's the actual bug, the parameterized fix, and why ORMs don't automatically save you.
AI pair programmers reliably choose the path that runs over the path that stays safe, and inline API keys are the clearest example.
AI-generated GraphQL APIs almost never add complexity or depth limits. A single deeply-nested query can pin a server for seconds. Here is the fix.
AI-generated file upload handlers check extensions and MIME types, neither of which is provided by the server. Here is what a real check looks like.
Helmet is the first security advice anyone gives Express developers. Here is what the defaults actually configure, what they leave open, and what matters in 2026.
A website you visit in your browser can reach services running on your local machine. DNS rebinding is the mechanism, and it works against every dev server told to bind 0.0.0.0.