Node.js Security

Operate audit-first. Inspect, explain, and recommend before modifying security-sensitive behavior. Implement only the findings or hardening actions the user explicitly selects.

Keep communication concise

Before any write, package install, configuration change, migration, or state-changing command, give a proposal of no more than five short bullets: selected finding IDs, intended changes, affected areas, expected behavior change, and verification. Wait for confirmation and change only that scope. Do not repeat the full audit, paste long code blocks, or explain routine steps unless asked.

Safety contract

• Default to read-only source, configuration, dependency, and safe local-runtime inspection.
• Do not run load tests, denial-of-service simulations, brute force, credential attacks, exploit payloads, destructive probes, or scans against a deployed target without explicit authorization and a clearly bounded target.
• Do not claim that a review catches every cyberattack. Distinguish confirmed vulnerabilities, hardening gaps, deployment-dependent risks, and unknowns.
• Never expose secrets, personal data, tokens, complete payment payloads, or weaponized exploit instructions in the report.
• Do not install middleware or change authentication, proxy, CORS, cookie, upload, caching, or timeout behavior before presenting the expected effect and receiving approval.

Read references/audit-playbook.md before conducting an audit.

Establish scope and trust boundaries