Will this Node.js API crash, leak or let anyone in?
Paste or drop the files behind one Express or Fastify service - the entry that creates the app, its
routers, middleware and error handler - and its package.json. Your browser maps every route,
its middleware chain and its handler, and checks them: async handlers whose rejections never reach
the error handler on Express 4, req.body read before the body parser, SQL built from request
input, the whole body written to the database, stack traces sent to clients, hardcoded secrets,
jwt.decode() used as verification, CORS that reflects any origin with credentials, responses
sent twice, login routes with no rate limit, sync calls that block the event loop, request input in file
paths and shell commands, writes with no authentication, and what Express 5 removed. Free, before you sign
in, and nothing is uploaded. Then pick a lane: the audit gives exact edits for each
finding, or the fix lane writes the whole fixed files - and the page re-checks both.
The companies, routes and values in the examples are invented. The first three are audits, the last two fix runs; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The audit rates errors, input, security and operations, confirms or dismisses every flag below, adds what rules cannot see, and gives exact before/after edits for each finding - which the page applies to your paste and re-checks.
What this does, and what it does not
The check is a reading of the text: nothing is installed, run or sent to your server. Each file is lexed so
strings, template literals, regex literals and comments are never mistaken for code; every
require() and import between pasted files is resolved (relative paths and the
@/ alias); every express(), Router() and fastify()
instance, every route with its method, its full path through the mount, its middleware chain and its
handler (inline, or found by name in another pasted file), and every use() in registration
order is mapped; and each flag carries the catalogue id it comes from and the line it points at. Checks only
see what you paste: middleware, helpers and database code in files you did not paste are outside the check
(the context flag names every handler it could not find), and so is how the service is deployed. Your tests,
a load test and a real request against each changed route remain the ground truth.
The paid lanes see your paste and the page's facts. Every quote and edit they return is checked against your paste, every edit and every returned file is put back and re-checked, and a reply that repeats a credential from your paste is called out. A paste stays in this browser unless you run a lane. Derived from the agent skill @wshobson/nodejs-backend-patterns by Seth Hobson (wshobson/agents, MIT). Express and Fastify are OpenJS Foundation projects; Routelarch is not affiliated with or endorsed by the OpenJS Foundation, Express or Fastify. Sources are listed in llms.txt.