- Register SanitizeInputMiddleware for all routes to prevent stored XSS - Register CsrfMiddleware for all routes (sets cookie on GET, validates on state-changing methods) - Remove unsafe-inline from CSP scriptSrc directive - AppModule now implements NestModule with configure() method Co-Authored-By: Paperclip <noreply@paperclip.ing>