Harden it: helmet, CORS, rate limits

The code works. Now make it safe to expose.

Modules 07–12 got you a real PawWalk backend — walkers, JWT auth, bookings, a job queue, and tests that prove it. But 'it passes tests on my laptop' and 'it's safe on the public internet' are two different bars. The moment this API has a public URL, it gets scanned, scraped, and brute-forced within minutes — automated, indiscriminate, all day.

Hardening isn't a feature you bolt on at the end; it's the difference between a demo and a service. This lesson adds the three cheapest, highest-leverage defenses: secure headers (helmet), a CORS allow-list, and rate limiting on the endpoints attackers hammer.

In an interview, say: Before I ship a Node service I add helmet for headers, a CORS allow-list, and a throttler on auth — the baseline that stops the boring, automated attacks so I can focus on the interesting ones.