Helmet security middleware imported is actually applied

Importing helmet and never calling app.use(helmet()) means none of its 15 default security headers — X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security, X-XSS-Protection, Referrer-Policy, and others — are actually set on any response. OWASP A05 (Security Misconfiguration) is the exact mapping. Without these headers, browsers don't enforce clickjacking protection, MIME-type sniffing defenses, or HSTS. An attacker who discovers the headers are absent can exploit XSS more easily or frame your app in an iframe for credential harvesting.

Mount helmet as middleware in your Express or Fastify entry point, before route definitions. The call must be in the application chain reachable from index.ts or server.ts.

// src/server.ts
import express from 'express'
import helmet from 'helmet'

const app = express()
app.use(helmet())  // applies all 15 default headers
app.get('/health', (req, res) => res.json({ ok: true }))

If you need to disable specific directives (e.g., contentSecurityPolicy: false for development), be explicit — don't disable everything. For Next.js, use next.config.js headers() instead; helmet doesn't apply to that framework.