Referencing a third-party GitHub Action by branch name instead of a commit SHA means your CI pipeline executes code you never reviewed, on every run, automatically.
Without a SIGTERM handler, a rolling deploy kills in-flight requests the moment the old process receives the signal, and the errors land on whichever users were unlucky enough to be mid-request.
AI-generated fetch and axios calls routinely skip timeouts, which turns one slow upstream dependency into a full outage of everything behind it.
A default string baked in as the JWT signing secret "for now" is one of the most common security holes AI assistants leave in generated auth code.
It looks random enough to pass a glance at the output. It is not unpredictable enough to generate a password reset token, and AI assistants suggest it constantly.
Selecting every column by default is convenient until one of those columns is a password hash or an internal note field, and it ends up in a JSON response nobody reviewed.
Node's most popular file upload middleware has no size cap unless you set one. A single request can fill your disk or your memory before you notice.
npm install prints peer dependency warnings and lets you proceed anyway. Most of the time that's fine. Sometimes it silently installs a version combination nobody has ever tested.
A scheduled job that fails without alerting anyone is worse than no job at all, because everyone assumes it's working. A dead man's switch catches what try/catch can't.