Hi Augusto,

• avoid using unpopular npm modules, github repositories;
• copy code from critical libraries into your own repository;
• if you use Fullstory or other screen recording services, then ignore user inputs (can be set up by following their inctructions);
• also never commit security keys to your repository;
• automate deployments via CircleCI and keep sensitive keys encrypted;
• do security scanning of your docker containers: cloud.google.com/container-re….

Hope it helps.