Every middleware, header, and validation rule that has actually stopped an attack — from a 7-year production record that includes one very expensive pentest.
The pentest report arrived on a Tuesday. Eleven findings, eight of them high severity. The client — an e-commerce backend serving about 40,000 requests a day — had everything a checklist of this kind is supposed to prevent: an open CORS policy, SQL injection on a search endpoint, a stack trace leaking database internals in a 500 response, and a session token being read from a log file. None of the attacks were exotic. Every single one was preventable with standard, boring middleware.
That week I wrote down every mitigation, in the order you should apply them, and turned it into a checklist. I have run that checklist on every Node.js service I have shipped since — APIs, webhooks, agent backends. This article is that checklist, with the code and the failure modes. Work through it top to bottom and you will have done more than most production systems on the internet.
Step 1: Get the Secrets Out of Your Code
The single highest-value fix is also the most boring: your code should contain zero secrets. No API keys, no database passwords, no JWT secrets, no connection strings. The environment is the only place secrets belong, and .env is gitignored before you write a single line.
