Skip to content

Expert · Performance and Node.js · topic 56 of 61 · 25 min

Real project tooling

Explanation

Professional JavaScript projects use ESLint to catch mistakes, Prettier to format code the same way for everyone, environment variables (.env files that are never committed) for secrets, a debugger with breakpoints instead of endless console.log, and bundlers like Vite or esbuild for front-end code. TypeScript can be run with tsc, tsx or, in recent Node versions, directly.

Why tooling?

Code is read far more often than it is written, by many people. Tools catch whole classes of mistakes automatically, keep style arguments out of code reviews, and protect secrets. Setting them up takes an hour and saves weeks.

ESLint: find problems

ESLint is a linter: it reads your code without running it and warns about likely bugs (unused variables, == instead of ===, a missing await, an unreachable line) and risky patterns. Rules are configured in eslint.config.js.

bash
npm install --save-dev eslint @eslint/js
npx eslint .            # report problems
npx eslint . --fix      # fix what can be fixed automatically

Prettier: format code

Prettier rewrites the layout of your code (spaces, quotes, line breaks) into one consistent style. Everyone's editor formats on save, and nobody argues about semicolons again. Let Prettier handle formatting and ESLint handle correctness.

Environment variables and secrets

Settings that change between your laptop, the test server and production (database URL, API keys, port) should come from environment variables, not be written in the code. Locally they often live in a .env file. Node can load it with node --env-file=.env app.js in recent versions, or with the dotenv package.

ini
# .env  (NEVER commit this file; add it to .gitignore)
PORT=3000
PAYMENT_API_KEY=test_key_here
DATABASE_URL=postgres://localhost/shop_dev
Commit a .env.example with the same names and fake values so teammates know what to set.
javascript
const port = Number(process.env.PORT ?? 3000);
const apiKey = process.env.PAYMENT_API_KEY;
if (!apiKey) throw new Error('PAYMENT_API_KEY is not set');
Careful: Secrets committed to Git stay in the history forever, even after you delete the file, and bots scan public repositories for keys within minutes. If a key is ever committed, rotate it (create a new one and disable the old one) immediately, then clean the history.

Debugging with breakpoints

  1. In VS Code, click left of a line number to set a breakpoint (a red dot).
  2. Start "Run and Debug" (or run node --inspect app.js and open chrome://inspect in Chrome).
  3. When execution stops, hover variables, look at the call stack, and step over / into / out of lines.
  4. Add a debugger; statement in code to pause there when DevTools is open.

A debugger shows every variable at the moment of the bug, which is usually faster than adding and removing console.log lines.

Bundlers and running TypeScript

Front-end code is usually bundled: a bundler (Vite, esbuild, webpack, Rollup) follows your imports, combines and minifies files, and handles TypeScript and JSX. For Node, you can compile TypeScript with tsc, run it with a tool like tsx during development, or, in recent Node versions, run simple .ts files directly because Node can strip the types; check the Node.js documentation for your version.

Think of it like this: ESLint is the senior colleague who reviews every line and points out "you forgot to return here". Prettier is the office stationery template that makes every letter look the same. The .env file is the locked drawer: everyone knows it exists, nobody photocopies what is inside.
Tip: Run lint, type-check and tests automatically on every push with CI (for example GitHub Actions). Problems are caught before code is merged, not after customers find them.

Need help?

Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.

Try:

Watch the lesson

Real project tooling · 1/7

Project tooling

In this lesson you will set up the tools every professional JavaScript project uses.

Prefer a video by a teacher? Find free videos on “eslint prettier setup node project dotenv environment variables” on YouTube ↗

In real life: The API key that leaked

A student pushed a project to a public GitHub repository with a payment-gateway test key inside config.js. Within an hour, automated scanners had found it. Because it was a test key, no money was lost, but the provider disabled it. The fix was moving the key to .env, adding .env to .gitignore, and generating a new key.

javascript
// config.js (safe version)
export const config = {
  port: Number(process.env.PORT ?? 3000),
  paymentKey: process.env.PAYMENT_API_KEY, // read at start-up, never hard-coded
};

Practice (0/3 done)

Task 1 · Code · Javascript

Write loadConfig(env) that reads PORT (default 3000, as a number) and PAYMENT_API_KEY (required) from an env object like process.env. Throw an Error "PAYMENT_API_KEY is not set" when the key is missing or empty.

Task 2 · Code · Javascript

Write parseDotEnv(text) that parses .env text into an object: one KEY=VALUE per line, ignore empty lines and lines starting with #, trim spaces around keys and values, and remove surrounding double quotes from values. Only split at the FIRST = sign.

Task 3 · Practice

In a small Node project: add ESLint (npm init @eslint/config@latest) and Prettier, create .env and .env.example, add .env and node_modules to .gitignore, and debug one function with a breakpoint in VS Code.

Quick quiz

Question 1

1.What does ESLint do?

Question 2

2.Where should an API key live?

Question 3

3.A key was committed to a public repo. What first?

Question 4

4.What does a bundler like Vite do?

Read more (free)

Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.

What does ESLint do?

Answer: Reads code without running it and reports likely problems

ESLint is a static analysis tool (a linter).

Where should an API key live?

Answer: In an environment variable / .env file that is not committed

Secrets stay out of the code and out of Git.

A key was committed to a public repo. What first?

Answer: Rotate the key: create a new one and disable the old one

Assume it is already copied; make it useless.

What does a bundler like Vite do?

Answer: Combines and optimises front-end modules for the browser

Bundlers follow imports and produce optimised files.

A session secret was pushed to a public GitHub repo. What fixes the problem?Related

Answer: Rotate: make a new secret, deploy it, and stop using the old one

The old value stays in git history and may already be copied. Only replacing it makes it useless.

From Environment variables and secrets

How can modern Node.js load a .env file without any package?Related

Answer: node --env-file=.env server.js

Node.js 20.6 and later understand the --env-file flag. Older projects use the dotenv package.

From Environment variables and config

Recent Node.js versions can run a .ts file directly. What do they do with the types?Related

Answer: Strip (remove) them without checking

Node.js strips the types so the code can run. Type checking still needs tsc or your editor.

From Why TypeScript

When does TypeScript report type errors?Related

Answer: Before running, when you compile or in the editor

Type checking happens at compile time.

From Why TypeScript

Pass the quiz (60% or more) or mark this topic as done when you are ready.

Your progress is saved on this device only.

Next steps

  1. This is the last topic of “Performance and Node.js”. The module exam comes next.
  2. Module 11 exam: Performance and Node.js · 12 questions · 25 min, without help. 5 topics of this module still to finish first.
  3. Then the next module, Interview preparation and career. 61 topics left in the course before the final exam.

← Previous: Files and a tiny server in Node