Common Node.js Security Bugs That Often Slip Into Production

A code review revealed SQL injection in a startup's production app that had been live for 8 months. Other frequent issues include committing secrets to git, using jwt.decode instead of jwt.verify, and missing rate limiting on auth endpoints. These bugs persist because code works normally until exploited.