# Security - The Best Way

**URL:** <https://discourse.nodered.org/t/security-the-best-way/76326>\
**Category:** General\
**Created:** [9 March 2023 00:14 UTC](https://discourse.nodered.org/t/security-the-best-way/76326 "2023-03-09T00:14:38Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![edilsonlucas](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edilsonlucas/32/40119_2.png) [@edilsonlucas](https://discourse.nodered.org/u/edilsonlucas)\
**Post date:** [9 March 2023 00:14 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/1 "2023-03-09T00:14:38Z")

</div>

Hello friends, I need your help on how to protect my application from hacker attacks. My application consists of a level monitoring system and I will be using Telegram to send messages when there is an event, but I could not understand about the vulnerability from node red. When using it, I'm theoretically opening a port to the internet when I need to use the telegram feature or to download repositories, so I end up having this vulnerability? What would be the best practices to protect my application and my server

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [9 March 2023 02:31 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/2 "2023-03-09T02:31:59Z")

</div>

> [@edilsonlucas](#):
>
> When using it, I'm theoretically opening a port to the internet when I need to use the telegram feature or to download repositories, so I end up having this vulnerability?

Depends on how you use Telegram. There are 2 ways and the simples creates a connection from Node-RED to Telegram which is significantly less risky than creating an inbound connection.

> [@edilsonlucas](#):
>
> What would be the best practices to protect my application and my server

Please have a look at this FAQ post for advice on how to safely access node-red over the internet.

> [@Safely accessing Node-RED over the Internet](https://discourse.nodered.org/t/safely-accessing-node-red-over-the-internet/45024):
>
> Update 2025-02-19 The best advice for most people doing home automation is still: Don't expose Node-RED to the outside world! Where you really have to have some outside access, keep it as hands-off and restricted as possible. For example, using a Telegram bot. Also keep it as minimal as possible, e.g. Don't expose the Editor - EVER! If you want to provide remote control of your heating or the precious plants in your greenhouse, provide explicit controls with strong limits. Don't expose ever…

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [9 March 2023 09:11 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/3 "2023-03-09T09:11:52Z")

</div>

Generally it is incoming ports that you need to worry about, as an open incoming port may allow a baddy to get into your system. Provided you have not opened any incoming ports in your router then you don't need to worry about that aspect of security.

---

<div class="post-metadata">

**Author:** ![edilsonlucas](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edilsonlucas/32/40119_2.png) [@edilsonlucas](https://discourse.nodered.org/u/edilsonlucas)\
**Post date:** [9 March 2023 12:10 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/4 "2023-03-09T12:10:12Z")

</div>

Hello friend, so NodeRed when used with telegram does not exist a certain correct risk?  
But a doubt that I have, when we are going to install some resources related to the libraries do we use the internet to download them? Thus there is some risk of vulnerability.

I do not intend to make my public application available on the internet as I understand the risk.

My only fear is that there is some risk of vulnerability, although the server has firewall systems and I believe that access will be difficult.

Thank you for your recommendations

And with each passing day I'm more in awe of the world of programming, especially NodeRed

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [9 March 2023 12:27 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/5 "2023-03-09T12:27:16Z")

</div>

The act of downloading libraries from the internet is no different to fetching web pages with a web browser.

There is a different potential risk, which is whether to trust the nodes you are installing. In theory a contrib node red node could be written by someone who wants to attack the system it is installed on. I have never heard of that happening though.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [9 March 2023 21:37 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/6 "2023-03-09T21:37:58Z")

</div>

> [@edilsonlucas](#):
>
> Hello friend, so NodeRed when used with telegram does not exist a certain correct risk?  
> But a doubt that I have, when we are going to install some resources related to the libraries do we use the internet to download them? Thus there is some risk of vulnerability.

Nothing in life is risk-free I'm afraid. But if you follow that route, you will have a hard time doing anything at all. Paranoia is useful - up to a certain point. After that, it is simply debilitating.

Unless you are the target of a nation-state level aggressor, downloading well-known software libraries from well-known sources is generally fairly safe since any attacker is usually found out pretty quickly.

If you really do need to be that careful, you should download the libraries using a separate device and manually check the code. Once confirmed, take the code to the server using a known safe storage device and good-old sneakernet. But you would need to be seriously at risk of attack with some seriously valuable systems to make that really worth while and in that case, I'd advise against using Node.js at all (including Node-RED). Or Telegram for that matter.

---

<div class="post-metadata">

**Author:** ![edilsonlucas](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edilsonlucas/32/40119_2.png) [@edilsonlucas](https://discourse.nodered.org/u/edilsonlucas)\
**Post date:** [10 March 2023 02:21 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/7 "2023-03-10T02:21:17Z")

</div>

Hello my friend, I understood about the risks and I believe that you helped me a lot, in this case I will leave the application on an internal network with this I believe it will be protected, I have been studying about Telegram and it allows a secure connection in addition to having the possibility to control the users who will receive the messages. Thanks a lot for your help.

---

<div class="post-metadata">

**Author:** ![edilsonlucas](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/edilsonlucas/32/40119_2.png) [@edilsonlucas](https://discourse.nodered.org/u/edilsonlucas)\
**Post date:** [10 March 2023 02:23 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/8 "2023-03-10T02:23:44Z")

</div>

Hello Colin, thanks your help-me. I'll be watching the libraries that will be installed and their developers..

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [24 March 2023 02:24 UTC](https://discourse.nodered.org/t/security-the-best-way/76326/9 "2023-03-24T02:24:42Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.