This title has been changed from its original. Mods? Node.js applications are one thing, Express.js applications are another. This seems to talk about the Expr

This title has been changed from its original. Mods? Node.js applications are one thing, Express.js applications are another. This seems to talk about the Express.js framework, and Express has its own set of guidelines that should be followed as the bare minimum, sadly in the "advanced" section: https://expressjs.com/en/advanced/best-practice-security.html https://expressjs.com/en/advanced/best-practice-security.htm... https://blog.risingstack.com/node-js-security-checklist/ https://blog.risingstack.com/node-js-security-checklist/ In reality I see two things that bite most outfits getting their feet wet with Node for the first time, and it's not how well the passwords are hashed. First is the age-old problem of input validation. Express.js devs read the tutorials that show bringing in data directly from req: https://expressjs.com/en/api.html#req https://expressjs.com/en/api.html#req ... and just accept it. Unvalidated input / unfiltered output seems par for the course in a lot of smaller Express.js APIs, especially when they are using Angular, Knockout or another client-side framework that offers some filtering of data being returned from the API. A close second is third-party dependencies. While the Node Security Project does what it can to help out, and nsp/snyk are good best practices, the Node.js culture of importing modules for everything often leads to really large attack surfaces with rarely-audited modules of unknown provenance added for development speed. Third-party modules -- especially less popular ones -- are a goldmine of critical vulnerabilities just as WordPress plugins used to be (and still are). Also, a lot of Node.js teams popping up from development shops et al consist of front-end engineers that have never needed to understand the systems-level impact of their code. Many are used to JS for talking to API black-boxes and making cool effects or reactive user interfaces, and they're not often thinking about directory traversal, SQL injection or cookie poisoning because those have traditionally not been in the domain of the JavaScript-oriented developer.