Quick security review for my small web app

I need someone to do a short security check on my small web app before I add more users. The app is built with a simple Node.js backend and a React frontend, with login through Keycloak. Please look for easy weak points, bad settings, and the most obvious OWASP issues. I do not need a big report, just practical notes and the top things I should fix first. If possible, please also tell me if the OAuth flow looks safe enough for a small app. This is a limited task, not a long audit.