34. Security basics

A handful of practices prevent the most common Node security incidents: never commit secrets to git (use environment variables and a `.gitignore`d `.env`), validate and sanitize all external input, keep dependencies patched (`npm audit`), and use parameterized queries for anything touching a database.

For services holding private keys (a hot wallet signer, a relayer), consider a dedicated secrets manager or HSM rather than plain environment variables — an exposed private key on a public blockchain can mean instant, irreversible loss of funds, unlike a leaked database password which can be rotated.