Plug SecureNow in

Out of the box, your app can't see the attacks aimed at it. A zero-day injection buried in a POST body, a scanner walking your routes, a credential-stuffing run — all of it just looks like ordinary traffic. This episode makes the app see: full traces, logs, and a firewall. Most of it needs no code change at all.

Before you start

• The lab running locally (npm install done), or your own Node app.
• A free SecureNow account — sign up at securenow.ai.

Step 1 — Install and connect

npm install securenow
npx securenow login          # admin auth, opens the browser
npx securenow app connect    # links this project to an app; writes .securenow/

app connect creates .securenow/runtime.json with your app key. That's the only wiring the SDK needs.

Step 2 — Load it with a preload (no code change)

Run your app with SecureNow preloaded. Nothing in your source changes:

node -r securenow/register src/server.js

That single flag installs HTTP tracing, logging, and the firewall around your app. Confirm it's healthy:

npx securenow doctor

Step 3 — Drive some traffic and watch it land

Use your app normally — sign in, hit a few routes. Then open the dashboard. Within seconds you'll see traces: every request with its method, path, status code, client IP, and (with body capture on) the request body — which is where zero-day injection payloads hide. You didn't instrument anything; the preload did it.

Step 4 — Turn on the firewall

The firewall blocks known-bad IPs and obvious exploit traffic before it reaches your handlers:

npx securenow firewall status

It answers bad requests with a 403 (or a drop) and keeps good bots on an allowlist — no network config, no proxy to stand up.

Step 5 — The optional bridge (only for advanced detection)

Here's the important nuance: most detections need no code. Injection, scanners, rate abuse, bad IPs — all caught from traffic alone.

You only add code when you want auth-aware protection — for example, detecting that a live session suddenly jumped to a new IP or country and then revoking it. That needs two small, optional pieces:

// 1) emit a structured event at each security decision (fire-and-forget, never throws)
const { track } = require("securenow/events");
track("auth.login.success", { userId, ip, attributes: { method: "password" } });

// 2) enforce revocations + record session.seen — one line of middleware
const securenow = require("securenow/sessions");
app.use(securenow.guard());

With the bridge in place, you can securenow revoke a stolen session and the next request from it gets a 401.

Step 6 — Hand the visibility to your agent

Now the payoff. With traces, logs, bodies, and auth events flowing, your AI agent has full context — it can investigate an incident, run forensics across traces and logs, and answer "what did this IP do?" better than digging through scattered tools by hand.

What you just did

You took a blind app and gave it complete visibility — traffic, bodies, logs, a firewall, and (optionally) auth-aware events — mostly without touching your code. In Episode 3 we turn the threat model's detections on and watch them catch a live attack.