express.json, express.urlencoded, cors, helmet, a logger (morgan or pino-http), express-rate-limit, cookie-parser (if using cookies), compression, a custom auth middleware, a validation middleware, and an error-handling middleware.

It sets security HTTP headers (X-Frame-Options, Strict-Transport-Security, Content-Security-Policy basics) that protect against clickjacking, sniffing, and other common attacks. Set it and forget it.

Limits requests per IP to prevent abuse and brute-force attacks. Add a global limiter (e.g., 100 req per 15 min) and stricter limiters on auth routes (5 login attempts per 15 min). It is a small addition with big protection.