Config variables have to be hidden

[devhyunjae]

Every server's secret configurations are raw string in config.js(i.e username: "root")

It needs to be hidden.

[lisong]

it a good choice use config.js like this CONFIG_FILE=/path/to/config.js NODE_ENV=production node ./bin/www. store config file in other dir.

[devhyunjae]

Yes, your choice is also good! But I think it depends on the server deploy situation. For me, using process env is more convenient. It is not bad for providing more options.