Node.js security starts with dependencies. Run npm audit regularly. Use Snyk for continuous vulnerability scanning. Pin dependency versions in production.
Input validation: never trust client data. Use joi or zod for schema validation. Sanitize inputs to prevent injection attacks.
Authentication: use bcrypt/argon2 for passwords. Implement JWT with short expiration and refresh tokens. Add rate limiting to auth endpoints.
HTTP security headers: use Helmet.js. It sets Content-Security-Policy, X-Frame-Options, and other protective headers.
Environment variables: never commit secrets. Use .env files locally and secret managers (AWS Secrets Manager, Vercel env vars) in production.
Common vulnerabilities: prototype pollution (avoid Object.assign with user input), command injection (never use eval), path traversal (sanitize file paths), and ReDoS (careful with regex).