Securing a Node.js Payment Service: A Checklist

Payment services are high-value targets. The difference between a secure service and a compromised one often comes down to a handful of practices that are easy to describe but require discipline to maintain. Here's the checklist I use.

Dependency Hygiene

Run npm audit on every CI build and fail on critical vulnerabilities. Pin dependencies to exact versions. Use a lockfile that's committed to the repository. Review new dependencies before adding them — every dependency is a potential attack vector, and the Node.js ecosystem has a long history of supply chain attacks.

Runtime Protection

Never log payment details, card numbers, or authentication tokens. Use Helmet for security headers. Set restrictive CORS policies — your payment API shouldn't accept requests from arbitrary origins. Rate limit authentication endpoints aggressively. Use express-rate-limit or equivalent, and make sure the rate limiter can't be bypassed by spoofing X-Forwarded-For headers.

Secrets Management

Never store secrets in code, config files, or environment variables committed to the repository. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, or even encrypted files with restricted access). Rotate secrets on a schedule. Have a plan for rotating secrets quickly if they're compromised.

Incident Response

Have a runbook. Know who to call, what to shut down, and how to preserve evidence. Test the runbook. The worst time to discover that your incident response process has gaps is during an actual incident. Run a tabletop exercise at least quarterly.