Node Project Rules Checklist
Twenty-five rules every Node.js HTTP service or worker should satisfy before production traffic.
//
Search across all documentation pages
Twenty-five rules every Node.js HTTP service or worker should satisfy before production traffic.
engines and Docker FROM node:24.18.0 align./health liveness; /ready checks DB when applicable.fs.readFileSync banned in request handlers..env gitignored.npm audit --audit-level=high passes in CI.{ error: { code, message } } across routes.cursor or limit/offset documented max limits.Idempotency-Key or natural keys for POST that create resources.console.log in src/.X-Request-Id in logs and outbound calls.npm ci. Reproducible installs only.tsc --noEmit on every PR.eslint --max-warnings 0.fetch to third parties.Workers need process health via supervisor metrics; HTTP health applies to API services. Rule 3 adapts to worker heartbeat.
Internal APIs still benefit from idempotency on create/charge endpoints to survive retries.
ESLint no-console in src/** plus CI lint gate (rule 18).
Nest uses Test.createTestingModule for tests but still needs graceful shutdown and same security/logging rules.
Document time-boxed exception (rule 10) with owner; do not silent-fail CI permanently.
Rules 1-2, 6-8, 11-15, 16-19 apply; Docker (21) becomes packaging config; shutdown (2) is runtime freeze aware.
Tech lead or reviewer tick on release ticket; store link to completed checklist.
This checklist summarizes; deep dives live in Async, Security, API, Dependency, and Logging rule articles in this section.
Yes for stable services; re-run after Node major upgrade or incident postmortem action items.
Aim for 16-20 fully in CI; 21-25 need docs and review but Docker/ADR can be template-enforced.
Stack versions: This page was written for Node.js 24.18.0 (Active LTS), npm 10+, TypeScript 5.6+, Express 5, Fastify 5, and NestJS 11.
Reviewed by Chris St. John·Last updated Jul 19, 2026