Well, I tried it. 😜 Sorry for the content-free post. #Sorrynotsorry

A couple comments:
- not sure why you're asking for a 'valid' email address when you're not doing any kind of email verification from what I can tell. Maybe best to just omit that for now. Or ask for a Vogons/VCF account name instead and let them do the work for you of weeding out the fakes.
- I hope you're not using a 1997 method of storing passwords!
- As much as I hate to say it, it's best to assume the database is going to get pwned by spambots & script kiddies at some point, unless you've made the backend much 'harder' than it looks. I used a BS password I made up on the spot (which I'm probably going to forget eventually (EDIT: I've already forgotten it)), and a junk email that doesn't correspond to my identity elsewhere. IMHO creating a 'fresh' codebase from scratch that asks for usernames & passwords in 2019 is asking for trouble.

(I didn't look through your code yet, because I'm not very good with it, but thanks for making it open source!)

Still, fun idea & happy to help out with testing.

Nifty project, and so far it looks nice. I'll be keeping an eye on your progress.

I'm assuming this is partly being done as a learning experience. For me, I couldn't imagine writing an entire web app in JS/Node. I only use it for little things because the lack of typing is infuriating. Also the unthreaded asynchronous nature leads to callback hell. I noticed some of that in your "controllers" code.

I would add some input validation (or is that done by by mongoose?) and a config file ASAP. Also, remove the node_modules folder from your repository; the user will install those on his own via npm.