docs: style guide pass on security hub

- punctuation inside quotes
- spell out acronyms on first use
- Node.js, not Node
- sentence-case title
- "application" consistently
- serial comma in heading

Author: jonchurch

src/content/pages/en/security/index.mdx

@@ -1,15 +1,15 @@
 ---
-title: Security Checklist
+title: Security checklist
 description: A checklist of the security decisions Express leaves to you, with a page on each one.
 ---
 
 import Alert from '@components/primitives/Alert/Alert.astro';
 
 Express intentionally leaves most security decisions up to application developers. This page is a checklist of those decisions, to use while building or deploying an Express application.
 
-Not every item will apply to your application, but consider each question before going to production. For items that apply, a "no", or a question you don't understand, means there is a fix to make or a topic to look at more closely. Each question links to a page covering what Express does, what can go wrong, and what to do about it. Questions without links are out of scope of Express itself or its family of middleware. The questions are ordered roughly by when you meet them while building an application.
+Not every item will apply to your application, but consider each question before going to production. For items that apply, a "no," or a question you don't understand, means there is a fix to make or a topic to look at more closely. Each question links to a page covering what Express does, what can go wrong, and what to do about it. Questions without links are out of scope of Express itself or its family of middleware. The questions are ordered roughly by when you meet them while building an application.
 
-This list is a gift to the Express community, from the community. It is not complete, and it is not a substitute for a general web security checklist. [OWASP](https://owasp.org/) covers the things this guide won't.
+This list is a gift to the Express community, from the community. It is not complete, and it is not a substitute for a general web security checklist. The [Open Worldwide Application Security Project (OWASP)](https://owasp.org/) covers the things this guide won't.
 
 ## What you should already know
 
@@ -23,7 +23,7 @@ This documentation focuses on the risks and mitigations specific to Express rath
 
 ## Express threat model
 
-You might ask yourself "if I have to do all this work to secure my application, does that mean Express isn't secure?". Fair question!
+You might ask yourself "if I have to do all this work to secure my application, does that mean Express isn't secure?" Fair question!
 
 The Express project takes responsibility for the security of its own code through ongoing security reviews, vulnerability reports, and fixes. Developers are responsible for the security of the applications they build with it, including how they configure and use Express and its middleware. The [Express threat model](https://github.com/expressjs/security-wg/blob/main/docs/ThreatModel.md) explains where that boundary sits.
 
@@ -36,8 +36,8 @@ If you believe you have discovered a security vulnerability in Express, please s
 ## Before you write a route
 
 - Are you on a [supported Express release](/support)?
-- Do you know where TLS terminates in front of your app?
-- Does CI run `npm audit` or an equivalent, and does someone act on it?
+- Do you know where Transport Layer Security (TLS) terminates in front of your application?
+- Does continuous integration (CI) run `npm audit` or an equivalent, and does someone act on it?
 - Are you watching [Express releases](https://github.com/expressjs/express/releases) and [security advisories](https://github.com/expressjs/express/security/advisories)?
 
 ## Untrusted input
@@ -50,7 +50,7 @@ If you believe you have discovered a security vulnerability in Express, please s
 
 - Are your route patterns free of [repetition that can be forced into catastrophic backtracking](/security/route-patterns)?
 - Is authentication and authorization middleware [mounted before every route it protects](/security/route-patterns)?
-- Does anything in front of the app that filters by path [match Express's routing rules](/security/route-patterns)?
+- Does anything in front of the application that filters by path [match Express's routing rules](/security/route-patterns)?
 
 ## Response sinks
 
@@ -67,8 +67,8 @@ If you believe you have discovered a security vulnerability in Express, please s
 
 ## Proxies and client identity
 
-- Is `trust proxy` [set to match your deployment](/security/proxies), and never `true` when a client can reach the app directly?
-- If your app is behind a proxy, is [`trust proxy` configured](/security/proxies) so features using `req.ip`, `req.hostname`, or `req.protocol` receive the correct client information?
+- Is `trust proxy` [set to match your deployment](/security/proxies), and never `true` when a client can reach the application directly?
+- If your application is behind a proxy, is [`trust proxy` configured](/security/proxies) so features using `req.ip`, `req.hostname`, or `req.protocol` receive the correct client information?
 
 ## Error handling
 
@@ -80,15 +80,15 @@ If you believe you have discovered a security vulnerability in Express, please s
 
 - Does every body parser have a [`limit` that matches what the route expects](/security/resource-exhaustion)?
 - Is there [rate limiting on login and other expensive endpoints](/security/resource-exhaustion)?
-- Are [server timeouts set](/security/resource-exhaustion), or is something in front of Node absorbing slow clients?
+- Are [server timeouts set](/security/resource-exhaustion), or is something in front of Node.js absorbing slow clients?
 
-## Sessions, cookies, CSRF, CORS
+## Sessions, cookies, CSRF, and CORS
 
 - Are cookies set with [`Secure`, `HttpOnly`, and `SameSite`](/security/sessions)?
 - Is the [cookie signing secret](/security/sessions) loaded from the environment rather than source?
 - Is the [session store](/security/sessions) something other than `MemoryStore` in production?
-- Do cookie-authenticated routes that change state have [CSRF protection](/security/csrf)?
-- Does CORS use an [explicit origin allowlist](/security/cors)?
+- Do cookie-authenticated routes that change state have [cross-site request forgery (CSRF) protection](/security/csrf)?
+- Does cross-origin resource sharing (CORS) use an [explicit origin allowlist](/security/cors)?
 
 ## Logging