Hi Node.js Devs 👋
Trying to get a handle of how can I best help unblock server-side developers in their appsec workflows...
Did we get the whole 3rd-party dependency vulnerabilities figured out?
What sort of help do you need?
What tool or resource can help unblock you?
What are you spending time on to secure your apps? (like is it secrets, env vars, authentication, thinking about your API security? something else?)
Abandon insecure node. And switch to deno
Parameter pollution and a lot of other things need considered. But your root runtime doesn’t support signing, isn’t founded on a language that supports security: rust with safe wrappers around C++ like V8, you are playing with fire
Given you have to use import. Require is not supported outside of library compatibility. Since require does not support tree shaking