Nil Gradisnik nilgradisnik

tl;dr

Don't run as root.
For sessions, set httpOnly (and secure to true if running over SSL) when setting cookies.
Use the Helmet for secure headers: https://github.com/evilpacket/helmet
Enable csrf for preventing Cross-Site Request Forgery: http://expressjs.com/api.html#csrf
Don't use the deprecated bodyParser() and only use multipart explicitly. To avoid multiparts vulnerability to 'temp file' bloat, use the defer property and pipe() the multipart upload stream to the intended destination.

	// use like this:
	// process.emit( 'app:log', module, arg1, arg2, ..., argN );

	var Module = require('module');

	function logConsole(method, module) {
	var args = [(new Date()).toJSON(), method];
	var index = 1;

	if (module instanceof Module) {

	define([

	'jquery',
	'underscore',
	'backbone',
	'marionette',
	'handlebars',
	'text!templates/app_view.html',

	'modules/mainMenuView/mainMenuView',

	// http://jsfiddle.net/suBPQ/

	$.ajax({
	url: "http://api_test_server.proudlygeek.c9.io/",
	success: function(data) {
	console.log(data);
	}
	});