What are the security best practices for Node.js applications?

1) Validate input, 2) Use HTTPS, 3) Secure headers (helmet.js), 4) Rate limiting, 5) SQL injection prevention, 6) XSS protection, 7) Update dependencies, 8) Environment variables for secrets, 9) Principle of least privilege.