Node security

Node security interviews test secure service defaults: dependency hygiene, secrets handling, input validation, and least privilege—not checklist buzzwords without placement in the request path.

Subtopics: dependency vulnerabilities, secrets handling, and input validation security.

On interviews: describe how you triage an npm audit finding, where secrets live in dev vs prod, and what you validate before touching a database query.

Common pitfalls: trusting devDependencies in production images, logging tokens, and validating only on the client or only at the UI DTO layer.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Minimize dependency surface; triage CVEs by reachability.
• Keep secrets out of code, logs, and client bundles.
• Validate size, shape, and encoding at boundaries.
• Run services with least privilege and safe defaults.