34. Security basics

A handful of practices prevent the most common Node security incidents: never commit secrets to git (use environment variables and a `.gitignore`d `.env`), validate and sanitize all external input, keep dependencies patched (`npm audit`), and use parameterized queries for anything touching a database.

js
// .env (never committed)
// PRIVATE_KEY=0xabc123...

// .gitignore
// .env

const key = process.env.PRIVATE_KEY;
if (!key) throw new Error("PRIVATE_KEY not set");

For services holding private keys (a hot wallet signer, a relayer), consider a dedicated secrets manager or HSM rather than plain environment variables — an exposed private key on a public blockchain can mean instant, irreversible loss of funds, unlike a leaked database password which can be rotated.

Check your understanding