You App is vulnerable.

[sundargautam18]

router.route("/").get(protect, getNotes);
router
  .route("/:id")
  .get(getNoteById)
  .delete(protect, DeleteNote)
  .put(protect, UpdateNote);
router.route("/create").post(protect, CreateNote);

The problem with this code is, if I am authenticated I can delete or edit someone's else post if I know post id.

[Bimman2021]

yes you're right thanks for the note