We should look to add:
https://www.npmjs.com/package/helmet
This would go in service/server.js
// Helmet helps you secure your Express apps by setting various HTTP headers
app.use(helmet());

We should also look at this:
https://www.npmjs.com/package/hpp
// Prevent HTTP parameter pollution.
app.use(hpp());