evilpacket/helmet — pull request #19 by EvanHahn (2013-11-02 17:04:55+00:00)
Title: Hide X-Powered-By header

Express (and possibly other Connect-based libraries) will, by default, send an HTTP header called `X-Powered-By`. If exploits in Express are found, this information could be used by an attacker.

Perhaps worth a version bump and/or an inclusion in `helmet.defaults`.