Node.js SME Cookbook

Sections

Node.js Core & Runtime

Node.js Basics How Node.js Works Installing & Version Management Node.js Release & LTS Policy The REPL & Quick Experiments Reading the Official Docs & Diagnostics Node.js Fundamentals Best Practices

Event Loop Basics libuv Phases Microtasks vs Macrotasks async/await in Node Event Loop Best Practices

Modules Basics CommonJS (`require`)ES Modules (`import`)package.json `"type"` & `exports`Modules Best Practices

TypeScript in Node Basics tsx vs tsc vs ts-node Typing Express/Fastify Handlers Zod at Boundaries TypeScript in Node Best Practices

Buffers Basics Text Encodings Buffers Best Practices

Streams Basics Readable & Writable Patterns Transform & Duplex stream/promises.pipeline Streams Best Practices

EventEmitter Basics Memory Leaks from Listeners Events Best Practices

Processes Basics child_process worker_threads Processes Best Practices

Built-in APIs Basics path and url Timers and Scheduler fs and fs/promises util and diagnostics crypto os and process Built-in APIs Best Practices

Tooling, Packages & Quality

Package Managers Basics package.json Scripts Lockfiles & Reproducible Installs Workspaces & Monorepos Package Managers Best Practices

Project Setup Basics Scaffolding APIs Turborepo for Node Project Setup Best Practices

Linting Basics Prettier Integration Typecheck in CI Import Boundaries Linting Best Practices

Testing Basics node:test & node:assert Vitest Supertest & HTTP Integration Testing Best Practices

Node Project Rules Checklist Async & Event Loop Rules Security Rules Dependency Rules Logging & Observability Rules API Rules Node.js Rules Best Practices

Architecture & System Design

Architecture & Design Basics Hexagonal Architecture in Node Architecture Best Practices

Configuration Basics Zod & env-schema Validation dotenv vs Platform Inject Configuration Best Practices

Modularity Basics Dependency Injection Patterns Use Cases & Services Modularity Best Practices

API Design Basics OpenAPI & Swagger Error Response Standards Pagination & Filtering API Design Best Practices

Debugging Basics Memory Leak Hunt Promise That Never Settles Event-Loop Stall Incident Debugging Best Practices

HTTP, Frameworks & Real-Time

HTTP Basics in Node Routing Without Frameworks Middleware Pattern Keep-Alive & Connection Limits HTTP Fundamentals Best Practices

Express Basics Error Handling in Express Security Middleware Express Best Practices

Fastify Basics JSON Schema Validation Fastify Plugins Logging with Pino Fastify Best Practices

NestJS Basics Dependency Injection Guards, Interceptors & Pipes NestJS + Prisma/TypeORM NestJS Best Practices

Hono Basics Hono on Node vs Edge Koa & Polka Lightweight Frameworks Best Practices

Real-Time Basics ws Library Server-Sent Events Real-Time Best Practices

Data, Auth & Integration

Databases Basics node-postgres (`pg`)Drizzle ORM Databases Best Practices

Caching Basics ioredis Caching Best Practices

Queues Basics BullMQ AWS SQS Consumers Queues Best Practices

Auth Basics JWT Access + Refresh OAuth2/OIDC Auth Best Practices

Integrations Basics Webhook Verification Retry & Outbound Resilience Stripe, Twilio & SDK Patterns Integrations Best Practices

Performance, Security & Observability

Performance Basics clinic.js Suite Performance Best Practices

Security Basics OWASP Top 10 for APIs Prototype Pollution SSRF Guards Security Best Practices

Logging Basics pino Request Correlation IDs Logging Best Practices

Observability Basics OpenTelemetry Node SDK Observability Best Practices

Resilience Basics Timeouts Everywhere Resilience Best Practices

Deployment, Platforms & Operations

Docker Basics Multi-Stage Builds Distroless & Alpine Trade-offs Non-Root Containers Docker Best Practices

Serverless Basics Lambda Handler Patterns @aws-sdk v3 Serverless Best Practices

CI/CD Basics GitHub Actions for Node Quality Gates CI/CD Best Practices

Platform Deploy Basics ConfigMaps & Secrets Platform Deploy Best Practices

Runtime Ops Basics Graceful Shutdown PM2 & systemd Runtime Ops Best Practices

Ecosystem & Team

Essential Libraries Basics zod pino date-fns / Luxon bullmq / ioredis Essential Libraries Best Practices

Agent Skills Basics API Scaffold Skill Queue Worker Skill Node Upgrade Skill Agent Skills Best Practices

Git Basics for Node Teams GitHub Actions Integration Git & GitHub Best Practices

CLI Basics for Node Process Inspection Linux CLI Best Practices

Onboarding Basics Frontend → Node Path Skills Matrix Team & Onboarding Best Practices

Tech-Lead Craft

Incident Basics OOM Killer Response Incident Response Best Practices

Delivery Basics Enterprise Delivery Best Practices

Tech Lead Basics on Node ADR: Framework Selection Code Review Standards Mentoring Junior Node Devs Technical Leadership Best Practices

Product Collaboration Basics Prioritizing Tech Debt Stakeholder Communication Working with Product Best Practices

Reference: B2B SaaS API Reference: Worker Fleet Reference: Internal CLI Tool Case Studies Best Practices

Governance Basics Coding Standards Governance Best Practices

/

/

© 2026 @csjcode|SystemsArchitect.io: Cloud Systems Tools|Terms

Search Documentation

Search across all documentation pages

Node.js SME/Security

Security

5 pages in this section.

1

Security Basics

Node threat model: untrusted input from HTTP, files, env.

Nodejs Security Basics

2

OWASP Top 10 for APIs

Node-specific mitigations checklist.

Nodejs Security Owasp Top

3

Prototype Pollution

`lodash` merges and unsafe `Object.assign` sources.

Nodejs Security Prototype Pollution

4

Block internal IP fetches from user-supplied URLs.

Nodejs Security Ssrf Guards

5

Security Best Practices

Principle of least privilege for service IAM and DB users.

Nodejs Security Best Practices List