SH004: X-Powered-By header exposes Express

Severity: low · Category: security · Applies to: express

Why it matters

The default header tells attackers which framework to target.

How to fix

Call app.disable('x-powered-by') or use helmet.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH004

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH004