Node-RED

Connecting a sensor, a web API and a notification service often requires small pieces of integration code and somewhere to run them. Node-RED provides a browser-based editor where you wire processing steps together into flows, then run those flows on its server. It is useful for device integrations and event-driven automation that benefit from a visible workflow. The editor can change live behavior, so its access controls and stored credentials matter as much as the flow itself.

Current guidance

The official security guide warns that the Node-RED editor is unsecured by default. It distinguishes HTTPS, editor/admin API authentication and protection of HTTP nodes or dashboards. Securing only one of those surfaces does not automatically protect the others, and an exposed editor can change how connected systems are controlled.

Use the documented current image identity, nodered/node-red, and preserve its /data directory for flows, configuration and installed nodes. Keep the credential encryption secret recoverable alongside the protected backup; losing it can leave saved flow credentials unusable. Pin contributed node packages and review their access to devices, APIs and local files.

Before an upgrade, restore into an isolated instance and disable real-world side effects such as actuators, email or payment calls. Check scheduled flows, message retries and context persistence, and avoid multiple replicas independently executing the same automation unless that behavior is designed. The retired stable chart does not retire Node-RED, and a working visual editor is not evidence that a flow is safe or durable.