[radovanjorgic]

Description

Harden the local HTTP test server by disabling Express's X-Powered-By header, returning synchronous results as explicit JSON, and escaping HTML-sensitive characters in JSON responses. Return the server handle so regression tests can close the listener reliably.

Snyk Code confirms these three low-severity findings are absent at the final commit:

• DisablePoweredBy
• ServerLeak
• XSS

This changes developer test tooling. Parsed result/error objects and asynchronous acknowledgements retain their existing shape.

Connected Issues

https://app.devrev.ai/devrev/works/ISS-387948

How to test

From code/, run npm ci, npm run build, npm run lint, and npm test under Node 22.23.3. All pass; the three new HTTP regression tests verify the missing framework header, escaped results/errors, and unchanged empty asynchronous acknowledgement. All three tests failed against the original response settings, with only the server handle returned for test cleanup.

Final-commit Snyk Code and dependency scans completed. Dependency advisory IDs are unchanged; no dependency files change.

Remaining findings

The existing fixture-path finding remains. Snyk Code also reports a new low HttpToHttps/test note for the regression test's HTTP client. That client sends synthetic data only to 127.0.0.1 on the temporary test server's assigned port; no credentials or remote endpoints are involved. Neither finding is suppressed.

Existing dependency remediation is covered separately by #102 and #103; other development dependency findings remain outside this change.

Checklist

• Added and ran three regression tests.
• Ran build and lint.
• Included How to test.