Fetching a user-supplied URL server-side, a common pattern for webhooks and link previews, lets an attacker point your server at internal services and cloud metadata endpoints it was never meant to reach.
Leaving the default error-handling middleware in place means unhandled exceptions return full stack traces, file paths, and sometimes query parameters straight to whoever triggered them.
Setting Access-Control-Allow-Origin to a reflected wildcard while also allowing credentials defeats the same-origin protections CORS exists to enforce, and it is a common outcome of pasting together two Stack Overflow answers.
Referencing a third-party GitHub Action by branch name instead of a commit SHA means your CI pipeline executes code you never reviewed, on every run, automatically.
Without a SIGTERM handler, a rolling deploy kills in-flight requests the moment the old process receives the signal, and the errors land on whichever users were unlucky enough to be mid-request.
AI-generated fetch and axios calls routinely skip timeouts, which turns one slow upstream dependency into a full outage of everything behind it.
A default string baked in as the JWT signing secret "for now" is one of the most common security holes AI assistants leave in generated auth code.
It looks random enough to pass a glance at the output. It is not unpredictable enough to generate a password reset token, and AI assistants suggest it constantly.
Selecting every column by default is convenient until one of those columns is a password hash or an internal note field, and it ends up in a JSON response nobody reviewed.