# Security best practices
<a name="nodejs-security"></a>

 When using Node.js and *npm* on AL2027, follow the upstream [Node.js security best practices](https://nodejs.org/learn/getting-started/security-best-practices) guide on the Node.js website. It covers application-level threats, including supply chain attacks. It also covers mitigations, such as using lockfiles and disabling lifecycle scripts.