LoopBack 3 was terrible - complicated, added no value, encouraged creating vulnerabilities, had lots of obvious vulnerabilities in official components. LoopBack 4 looks pretty different, but I wouldn’t trust it to be good unless the entire team and philosophy behind it has been replaced.
I've been using LoopBack 3 in production for 18 months.
> added no value
It gives you an API explorer, routing, ORM, validation, error normalization, authentication, authorization via ACL, and more out-of-the-box. I'd consider this value.
> had lots of obvious vulnerabilities
I'd like to know more about this. The only thing I can think of is bypassing ACLs via fetching records and including relationships. I don't know of any framework or combination of libraries that doesn't have this vulnerability.
> LoopBack 3 was terrible - complicated
This is probably true. LoopBack 3 essentially uses a single model to represent your API and data model. This is the single responsibility principle taken to the extreme opposite. It's a complete nightmare at times. If you have an exact one-to-one mapping of your API to database, this may not be a problem.
> unless the entire team and philosophy behind it has been replaced
