docs: update security best practices for current threat model

[RafaelGSS]

• Align examples with current SECURITY.md threat model
• Add scenarios for malicious deps and prototype pollution
• Document Node.js permission model usage
• Refresh policy mechanism guidance and external security resources

PTAL @nodejs/security-wg

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
nodejs-org	Ready	Preview	Nov 25, 2025 7:04pm

[github-actions]

👋 Codeowner Review Request

The following codeowners have been identified for the changed files:

Team reviewers: @nodejs/security-wg

Please review the changes when you have a chance. Thank you! 🙏

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 76.41%. Comparing base (563f9eb) to head (4dc88ed).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8374      +/-   ##
==========================================
+ Coverage   76.40%   76.41%   +0.01%     
==========================================
  Files         118      118              
  Lines        9928     9928              
  Branches      334      334              
==========================================
+ Hits         7585     7586       +1     
+ Misses       2341     2340       -1     
  Partials        2        2              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

This PR updates the security best practices documentation to align with the current Node.js threat model, clarifying the distinction between Node.js core vulnerabilities and application-level security concerns. The changes enhance the documentation with concrete examples, updated guidance on security mechanisms, and new information about the Node.js permission model.

• Adds clarifying introductions to major threat sections explaining the Node.js threat model scope
• Provides concrete, realistic examples for malicious dependencies and prototype pollution scenarios
• Documents the Node.js permission model as a runtime security mechanism
• Updates policy mechanism guidance and adds new external security resources

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.

[github-actions]

📦 Build Size Comparison

Summary

Metric	Value
Old Total Size	3.51 MB
New Total Size	3.51 MB
Delta	0 B (0.00%)

Changes

➕ Added Assets (1)

Name	Size
.next/static/chunks/6f23856e2717fe73.js	204.48 KB

➖ Removed Assets (1)

Name	Size
.next/static/chunks/04a07082bdfb95c8.js	204.48 KB

[github-actions]

Lighthouse Results

URL	Performance	Accessibility	Best Practices	SEO	Report
/en	🟢 96	🟠 88	🟢 100	🟢 100	🔗
/en/about	🟢 100	🟢 93	🟢 100	🟠 88	🔗
/en/about/previous-releases	🟢 98	🟢 93	🟢 100	🟢 100	🔗
/en/download	🟢 90	🟢 96	🟢 100	🟢 100	🔗
/en/download/archive/current	🟢 100	🟢 100	🟢 100	🟢 100	🔗
/en/blog	🟢 100	🟢 100	🟢 96	🟢 100	🔗