# Protecting Node-RED from itself
**URL:** https://discourse.nodered.org/t/protecting-node-red-from-itself/84904
**Category:** FAQs
**Tags:** security
**Created:** [25 January 2024 09:55 UTC](https://discourse.nodered.org/t/protecting-node-red-from-itself/84904 "2024-01-25T09:55:07Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [25 January 2024 09:55 UTC](https://discourse.nodered.org/t/protecting-node-red-from-itself/84904/1 "2024-01-25T09:55:07Z")
Because Node-RED is a general-purpose computing tool, it has the capabilities to make changes to the underlying Operating System environment.
So if you want your instance of Node-RED to be "safe", especially in production and customer environments, it is important to prevent Node-RED from making changes to its own environment.
Here are the things you should certainly do as a minimum if you need a secure environment:
- Protect `settings.js`
- Protect certificate and key files
- No Internet access to the Editor
These things are more dependent on how secure you need your environment to be:
- Managing the node palette
- Host filing system
- Limit network access from flows
I expect that there are more ideas that people can, and should, add to this thread, this is just a quick brain-dump.
And, as always, please remember that this information is provided with no warrantee or guarantee. It is friendly advice not professional advice. Always have your security checked by professionals.
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [26 January 2024 20:12 UTC](https://discourse.nodered.org/t/protecting-node-red-from-itself/84904/2 "2024-01-26T20:12:19Z")
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [24 February 2024 09:55 UTC](https://discourse.nodered.org/t/protecting-node-red-from-itself/84904/3 "2024-02-24T09:55:25Z")
This topic was automatically closed after 30 days. New replies are no longer allowed.