A developer's take on security
summary
Practical, repeatable steps: stop running npm install in production and build dependencies in CI then export them as artifacts; add an ESLint plugin that fails CI on accidental eval use; run npm audit and npm audit fix in CI; use npm audit resolver to record ignores, set 24‑hour reminders, or remove deps so decisions are tracked. The workflow runs across 25 Node.js applications in CI and succeeds at keeping dependency vulnerabilities visible and manageable.
AI-written summary · about
chapters (4)
related talks
52mBest Practices for Developers to Master Security
35mStart me up, safe!
42mContinuous Security: Integrate security tools into your DevOps Pipeline
29mAll your packages are belong to us - Protecting your npm dependencies
42mSecuring Your Software Supply Chain
26mHow npm is Making JavaScript Safe For Everyone
25mSecurity First
23mProtecting Your npm Dependencies