"use Open source software", "add logging", "set all pages to HTTPS" and follow a "top 10 list of the most critical security threats"
Sad state of things.
The concept of having your work done by "Full Stack Developer" will not be nice for opening up potential security holes, in my opinion.
Additionally, I don't think there exists a real "Full Stack" dev, and I'm not alone in this opinion; click anywhere:
https://medium.com/swlh/the-full-stack-developer-is-a-myth-4...
https://news.ycombinator.com/item?id=10182936
http://andyshora.com/full-stack-developers.html
https://frontendmasters.com/books/front-end-handbook/2017/pr...
https://vitamintalent.com/blog/the-myth-of-the-full-stack-de...
https://techcrunch.com/2014/11/08/the-rise-and-fall-of-the-f...
https://www.propelrr.com/blog/ux/full-stack-web-developer.ht...
A proper full stack dev can make design and implementation decisions at all levels, while being able to visualise the affect of those changes over the entire system, in detail, at low level. They're also able to communicate these changes not only to a uber-low-level introverted developer, they're also able to sit with the CEO/CTO and rationalise their decision in terms of cost and savings.
And of course, they're able to drop anchor, exit the elevator at any level and get on the tools.
But even in a team of 2 people you can have a good front-end developer and a good back-end developer.
While there may be such a tool, I'm not aware of something like this that runs as a first party script and uses local storage. It would indeed be very useful to escape the logs->screenshots->can't reproduce cycle mentioned.
Your concern is fair, though many modern analytics tools can capture PII if not properly configured. It is important when using any such tools, including LogRocket, that developers understand the scope of the data collected and properly censor things like SSN, Credit Cards, or health data.
Some of our more security-conscious customers also just run LogRocket on their own servers with our self-hosted version. In this case, the script becomes first party, and they can configure behavior where no data leaves the client unless a user specifically gives permission.
Now that's just mean. Why can't he just say it there!
https://expressjs.com/en/advanced/best-practice-security.htm...
https://blog.risingstack.com/node-js-security-checklist/
I am also curious to know what's wrong with express.
