A ranked list of the security scanning tools that actually fit a solo developer shipping AI-generated code, from static analysis to secrets detection to supply-chain checks.
Most zip extraction libraries write each entry wherever its stored path says to by default, which means a malicious archive can write files outside the folder you meant to extract into.
Mounting Swagger or OpenAPI docs at a public route with no authentication hands anyone who finds it a complete, interactive reference to every endpoint, parameter, and internal field your API has.
A password reset or login endpoint that responds differently depending on whether an account exists lets an attacker build a confirmed list of real users one request at a time.
Raising express.json's size limit at the application level so one endpoint can accept a large payload quietly gives every other route the same oversized limit, and with it a memory exhaustion risk.
Static file servers have no concept of a sensitive file, so a .env or .git directory that ends up inside the served folder gets delivered to anyone who requests it by name.
window.addEventListener('message', ...) delivers events from any frame on the page unless the handler checks event.origin, which makes an unchecked listener a trust boundary with no lock on it.
Production source maps map a minified bundle straight back to original file names, comments, and logic, and most bundlers generate them by default without deciding whether they should be publicly reachable.
Reading the client IP from X-Forwarded-For without validating it against a trusted proxy hop lets anyone bypass IP-based rate limits and allowlists by setting their own header.