expo-api-routes
Provides guidelines for creating secure API routes in Expo Router, ensuring safe handling of server-side secrets and database operations.
Install this skill
Security score
The expo-api-routes skill was audited on Feb 19, 2026 and we found 21 security issues across 4 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 143 | Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, |
Template literal with variable interpolation in command context
| 353 | `https://api.weather.com/v1/current?city=${city}&key=${process.env.WEATHER_API_KEY}` |
Curl to non-GitHub URL
| 209 | curl http://localhost:8081/api/hello |
Curl to non-GitHub URL
| 210 | curl -X POST http://localhost:8081/api/users -H "Content-Type: application/json" -d '{"name":"Test"}' |
Fetch to external URL
| 139 | const response = await fetch("https://api.openai.com/v1/chat/completions", { |
Fetch to external URL
| 265 | const response = await fetch("https://api.example.com"); |
Fetch to external URL
| 304 | const response = await fetch("/api/hello"); |
Fetch to external URL
| 308 | const response = await fetch("/api/users", { |
Webhook reference - potential data exfiltration
| 16 | - **Webhook endpoints** — Receive callbacks from services like Stripe or GitHub |
Access to .env file
| 132 | Use `process.env` for server-side secrets: |
Access to .env file
| 143 | Authorization: `Bearer ${process.env.OPENAI_API_KEY}`, |
Access to .env file
| 158 | - **Local**: Create `.env` file (never commit) |
Access to .env file
| 290 | url: process.env.TURSO_URL!, |
Access to .env file
| 291 | authToken: process.env.TURSO_AUTH_TOKEN!, |
Access to .env file
| 353 | `https://api.weather.com/v1/current?city=${city}&key=${process.env.WEATHER_API_KEY}` |
External URL reference
| 139 | const response = await fetch("https://api.openai.com/v1/chat/completions", { |
External URL reference
| 204 | This starts a local server at `http://localhost:8081` with full API route support. |
External URL reference
| 209 | curl http://localhost:8081/api/hello |
External URL reference
| 210 | curl -X POST http://localhost:8081/api/users -H "Content-Type: application/json" -d '{"name":"Test"}' |
External URL reference
| 265 | const response = await fetch("https://api.example.com"); |
External URL reference
| 353 | `https://api.weather.com/v1/current?city=${city}&key=${process.env.WEATHER_API_KEY}` |
Install this skill with one command
/learn @expo/expo-api-routes