We are shipping backend APIs faster than ever because AI coding models make it trivial, but most of those services go to production with no real security: no rate limiting, no security headers, permissive CORS, open prototype pollution, leaking error responses. At the same time, supply-chain attacks are now the cheap way in. No mainstream Node framework ships these protections on by default, and the one stack with great docs ergonomics (FastAPI) is in Python.

This talk introduces DaloyJS, a TypeScript framework that closes those gaps: FastAPI-style auto-generated API docs from a single route definition, a contract-first design where one route powers validation, types, OpenAPI, a typed client, and tests, and security that is genuinely default-on, including a guardrailed core, first-party auth/CORS/CSRF/rate-limit middleware, and a "refuse to boot" mode that stops the app from starting on unsafe config.