Normal In router.test
app = express().use(router);
CSRF protection is disabled for your Express app. This allows the attackers to execute requests on a user's behalf.
also same line
Disable X-Powered-By header for your Express app (consider using Helmet middleware), because it exposes information about the used framework to potential attackers.