Skipping the USER instruction in a Dockerfile is the default, not a deliberate choice, and it quietly removes one of the two layers standing between a container bug and the host.
An endpoint that fetches a resource by its route parameter without checking ownership will happily return anyone's data, and sequential IDs make it trivial to find them all.
A ranked list of the security scanning tools that actually fit a solo developer shipping AI-generated code, from static analysis to secrets detection to supply-chain checks.
Most zip extraction libraries write each entry wherever its stored path says to by default, which means a malicious archive can write files outside the folder you meant to extract into.
Mounting Swagger or OpenAPI docs at a public route with no authentication hands anyone who finds it a complete, interactive reference to every endpoint, parameter, and internal field your API has.
A password reset or login endpoint that responds differently depending on whether an account exists lets an attacker build a confirmed list of real users one request at a time.
Raising express.json's size limit at the application level so one endpoint can accept a large payload quietly gives every other route the same oversized limit, and with it a memory exhaustion risk.
Static file servers have no concept of a sensitive file, so a .env or .git directory that ends up inside the served folder gets delivered to anyone who requests it by name.
window.addEventListener('message', ...) delivers events from any frame on the page unless the handler checks event.origin, which makes an unchecked listener a trust boundary with no lock on it.