Panel: Building A Secure Ecosystem for Node.js
summary
The Node.js Security Working Group reports running two active HackerOne programs (one for npm modules, one for Node core), triaging incoming reports, assigning CVEs, and maintaining a beta security advisory API (Heroku-hosted) that powers searchable vulnerability data. A NodeSource survey of ~1,600 devs finds ~87% feel insecure about their own code. Work underway includes npm module insights (tests, support, disclosure practices), migrating advisories to a repo, encouraging 2FA for npm accounts, and promoting hands-on training like node-goat. Continuous triage is emphasized.
AI-written summary · about
chapters (9)
- 0:00Start
- 0:55Stephanie Evans
- 1:15Michael Dawson
- 1:47What Is the Security Working Group Doing
- 3:20What Should We Be Doing To Make Sure that Developers Are Building You Know a Safe Safe Node js Applications
- 18:08Module Insights
- 19:40What Keeps You Up at Night
- 23:23The Security Working Group
- 25:07Future of the Security Working Group
related talks
47mImproving the Security of a Large Open Source Project One Step at a Time
48mImproving the Security of a Large Open Source Project One Step at a Time
27mState of Node.js Security- 48mImproving the Security of a Large Open Source Project One Step...
47mBlack Clouds and Silver Linings in Node.js Security
30mWhat's Really Going on Inside Your Node_Modules Folder
21mThe Security Toolbox For Node
26mHow npm is Making JavaScript Safe For Everyone