Node-RED

Node-RED at a glance

Node-RED is a popular open-source flow-based programming tool for wiring together devices, APIs and services, widely used in IoT and home automation. Node-RED ships regular releases plus security fixes; as a system that executes flows (and code) and holds credentials to connected services, hardening and timely updates matter.

For admins Node-RED can run arbitrary logic and reach many systems, so secure the editor: enable authentication (it's off by default), put it behind TLS, and never expose an unauthenticated editor to the internet — an open Node-RED is remote code execution. Keep it and Node.js current for security fixes. Nodes installed from the palette carry supply-chain risk — vet them. Back up flows and credentials before updates. Because it often drives physical devices, treat availability and access seriously. After updating, verify that flows run and credentials still authenticate. It commonly pairs with Home Assistant and MQTT. Patchletter surfaces new Node-RED releases.