Secure your Node.js apps and APIs.
Node.js apps depend on hundreds of open-source packages and often hold the keys to your database and payment provider. BurstLayer watches both, and checks the traffic that reaches your API.
Most of your app is code you did not write.
A typical Node.js project pulls in hundreds of packages from npm, the public library of JavaScript code. When a flaw is found in one of them, or a package is taken over by an attacker, every app that uses it is exposed.
What attacks Node.js apps
Some threats arrive through your dependencies, others through the requests that hit your API.
Packages with known flaws
We compare your dependencies with published security warnings and tell you which ones actually matter for your app.
Poisoned packages
Sometimes a popular package is taken over and new versions carry harmful code. We stop those versions before they reach production.
Leaked keys
Database passwords and API keys pasted into code or logs. We find them and help you replace them.
Injection attacks
Requests crafted to trick your app into running database commands. Network Overwatch blocks them before they reach your API.
Abuse of your API
Bots that copy your data or hammer your login endpoint. We limit them and keep the app fast for real users.
Exposed debug pages
Error pages and admin routes that show too much about your app. We find them and flag them.
Only the alerts that matter.
Most dependency warnings do not affect your app. BurstLayer checks whether your code actually uses the vulnerable part, and puts the real risks first.
- Real risks first, noise last
- A safe version suggested for every alert
- A pull request opened when you approve
This version has a published flaw in its template function that can let crafted input run code. Your app calls that function in src/emails/render.ts.
- 14 other warningsYour code never calls the affected parts
- 2 packagesUnused, safe to remove
How BurstLayer protects your Node.js app
We check your repository on every push and, if you add our package, the requests reaching your running app.
Dependency checks
Every push is checked against published security warnings for npm packages.
Fixes as pull requests
We open a pull request with the safe version, so your tests run before anything changes.
Secret detection
Keys and passwords in code, commits and logs are found before an attacker finds them.
An API firewall
Injection attempts and known attack patterns are blocked before they reach your routes.
Limits that adapt
Bots that hammer your API are slowed down while real users keep their speed.
Alerts from your running app
A small package reports errors and unusual requests from production.
Add BurstLayer to your app in two lines.
Install the package and add one line at the top of your server's entry file. It works with Express, Fastify, NestJS, Next.js and plain Node.js 18 or newer.
$ npm install @burstlayer/node✓ added 1 package// at the top of server.jsimport '@burstlayer/node/register'✓ Connected. Watching requests to api.example.com
Your key is read from the BURSTLAYER_KEY environment variable and never written into your code.
- 01
Connect your repository
Link GitHub, GitLab or Bitbucket so we can check your dependencies on every push.
- 02
Add the package
Two lines give us a view of the requests reaching your running app.
- 03
Review and merge
Fixes arrive as pull requests. Merge them like any other change.
The products behind it
Each one works on its own. Together they cover Node.js apps, from the network edge to the last line of code.
Questions, answered.
Will the package slow down my API?+
Checks run alongside your app instead of in front of every request, so your users will not notice them.
Do you see my source code?+
Only if you connect a repository, and only to check dependencies and secrets. You can limit access to specific repositories.
Which frameworks are supported?+
Express, Fastify, Koa, NestJS, Hono, Next.js and any app built on Node's own web server.
Does it work in serverless functions?+
Yes. It works on Vercel, Netlify, AWS Lambda and similar platforms.
Ship your next release with BurstLayer on.
Free for your first project. Connect a repository and see which warnings actually matter.