https://expressjs.com/en/advanced/best-practice-security.htm...
https://blog.risingstack.com/node-js-security-checklist/
I am also curious to know what's wrong with express.