Add TODOs for Express security & best practices

package.json

@@ -44,6 +44,7 @@
     "@remix-run/node": "^2.9.1",
     "@remix-run/react": "^2.9.1",
     "aws-cdk-lib": "2.140.0",
+    "compression": "^1.7.4",
     "constructs": "^10.0.0",
     "cross-env": "^7.0.3",
     "express": "^4.19.2",

server.js

@@ -1,13 +1,17 @@
 import { createRequestHandler } from "@remix-run/express";
 import express from "express";
+import compression from "compression";
+// TODO: add protection with helmet (see https://github.com/dev-xo/remix-saas/blob/main/server.mjs)
+// TODO: add rate limiting (see https://github.com/dev-xo/remix-saas/blob/main/server.mjs)
+// TODO: add CSRF and honeypot protection (see https://github.com/dev-xo/remix-saas/blob/main/server.mjs)
 
 const viteDevServer =
   process.env.NODE_ENV === "production"
     ? null
     : await import("vite").then((vite) =>
         vite.createServer({
           server: { middlewareMode: true },
-        }),
+        })
       );
 
 const app = express();
@@ -18,8 +22,10 @@ const app = express();
  */
 app.disable("x-powered-by");
 
+app.use(compression());
+
 app.use(
-  viteDevServer ? viteDevServer.middlewares : express.static("build/client"),
+  viteDevServer ? viteDevServer.middlewares : express.static("build/client")
 );
 
 const build = viteDevServer