How Tos & Tutorials

Learn how to use SecureNow with these step-by-step tutorials. We'll show you how to secure your applications and monitor threats effectively.

Lhoussine

Create Custom Alert Rules From the Command Line

SecureNow 8.1 adds `securenow alerts rules create` — define your own detection rules from SQL, scope them to your apps, and ship them without leaving the terminal. Here's how, with a real magic-link brute-force example.

Jun 11

Lhoussine

Secure a Next.js App with SecureNow Using This AI Onboarding Prompt

A copy-paste prompt that lets an AI coding agent install SecureNow, wire Next.js instrumentation, verify traces and logs, deploy to AWS, simulate attacks, and prove firewall blocking with human approval gates.

May 18

Lhoussine

Adding Backend Tracing to a Sentry Stack with OpenTelemetry

If your team uses Sentry for frontend errors and needs backend distributed tracing without doubling the Sentry bill, here's the OpenTelemetry path that doesn't make you choose.

May 9

Lhoussine

How to Block Bot Traffic in Express With No Extra Infra

Five approaches to bot blocking in Express, ranked by effort vs. effectiveness. From a 5-line allowlist to a full IP-reputation firewall — all without Cloudflare, AWS WAF, or any new infrastructure.

May 9

Lhoussine

How to Block Bot Traffic in Fastify With No Extra Infra

Fastify hooks (onRequest) and the SecureNow preload both work cleanly. Here's the production setup for IP blocking and user-agent filtering.

May 9

Lhoussine

How to Block Bot Traffic in NestJS With No Extra Infra

NestJS guards, interceptors, and global middleware all give you bot-blocking hooks. Here's the cleanest pattern for each.

May 9

Lhoussine

How to Block Bot Traffic in Next.js With No Extra Infra

Three patterns for bot blocking in Next.js — middleware, instrumentation, or preload — ranked by what works on Vercel, self-host, and the App Router.

May 9

Lhoussine

How to Block Bot Traffic in Nuxt With No Extra Infra

Nuxt server middleware + Nitro hooks give you bot-blocking primitives. Here's the production setup for self-hosted Nuxt 3.

May 9

Lhoussine

Capturing Request Bodies for Forensics in Express Without Leaking Secrets

Full request bodies make incident investigation 10x faster — and leak passwords, tokens, and PII if you do it naively. Here's the redaction-aware capture pattern for Express.

May 9

Lhoussine

Capturing Request Bodies for Forensics in Fastify Without Leaking Secrets

A Fastify preHandler hook captures bodies for forensics. Here's the redaction-aware version that won't put passwords in your logs.

May 9

Lhoussine

Capturing Request Bodies for Forensics in NestJS Without Leaking Secrets

NestJS interceptors give you a clean hook for body capture. Here's the redaction-aware pattern that works across REST, GraphQL, and microservices.

May 9

Lhoussine

Capturing Request Bodies for Forensics in Next.js Without Leaking Secrets

Next.js Route Handlers and Server Actions need redaction-aware body capture. Here's the pattern that works in App Router.

May 9

Lhoussine

Capturing Request Bodies for Forensics in Nuxt Without Leaking Secrets

Nuxt server middleware + h3 utilities give you a clean hook for body capture. Here's the redaction-aware pattern that works on Nuxt 3 and self-hosted Nitro.

May 9

Lhoussine

Continuous Application Security Monitoring on a $0 Budget

You don't need a $50k/year ASM contract to get continuous security monitoring. Here's the OpenTelemetry-based stack that works on the free tier of every component.

May 9

Lhoussine

Tracking Customer Cost-of-Serve from Your Trace Data

If you can't see which customer is consuming 40% of your CPU, you can't price your enterprise tier. Here's how to derive cost-of-serve per customer from OpenTelemetry traces.

May 9

Lhoussine

Adding an IP Firewall to Express Without Cloudflare

You don't need a CDN to block bad IPs. Here's how to wire a 500k-entry IP blocklist into Express in one line, plus the manual fallback for teams that want zero dependencies.

May 9

Lhoussine

Adding an IP Firewall to Fastify Without Cloudflare

Fastify's onRequest hook + a managed blocklist gives you a real IP firewall in one line. No CDN, no DNS changes.

May 9

Lhoussine

Adding an IP Firewall to NestJS Without Cloudflare

NestJS sits on top of Express or Fastify. Either way, the SecureNow preload adds a 500k-IP firewall in one line — no DNS changes.

May 9

Lhoussine

Adding an IP Firewall to Next.js Without Cloudflare

On Vercel, Edge middleware blocks at the edge. On self-host, the SecureNow preload blocks at the HTTP server. Both work without DNS changes.

May 9

Lhoussine

Adding an IP Firewall to Nuxt Without Cloudflare

On self-hosted Nuxt the SecureNow preload works. On Vercel-deployed Nuxt, server middleware + Vercel KV gives you the same outcome.

May 9

Lhoussine

How to Migrate from Datadog APM to OpenTelemetry in One Afternoon

A pragmatic four-hour migration playbook from Datadog APM to OpenTelemetry-native observability — including the gotchas nobody warns you about.

May 9

Lhoussine

Per-Tenant SLOs in a Multi-Tenant SaaS with OpenTelemetry

Aggregate SLOs hide the customer who's about to churn. Here's how to track per-tenant error rates and latency using standard OpenTelemetry conventions.

May 9

Lhoussine

Rate Limiting in Express That Actually Works (And 3 Ways It Usually Doesn't)

express-rate-limit is the right starting point. Here's how to configure it for production, when its in-memory store breaks, and the three subtle mistakes that make rate limits useless.

May 9

Lhoussine

Rate Limiting in Fastify That Actually Works

@fastify/rate-limit + Redis is the production-grade combo. Here's the config that handles trust proxy, per-route limits, and per-user keys correctly.

May 9

Lhoussine

Rate Limiting in NestJS That Actually Works

ThrottlerModule is the right starting point. Here's the production config, the Redis-backed shared store, and per-route customization.

May 9

Lhoussine

Rate Limiting in Next.js That Actually Works

Edge middleware + Vercel KV gives you proper rate limiting without an extra service. Here's the production setup with the gotchas Vercel docs don't cover.

May 9

Lhoussine

Rate Limiting in Nuxt That Actually Works

Nuxt 3 doesn't ship a rate-limit module, but Nitro's event handlers + Upstash Redis give you production-grade rate limiting in 30 lines.

May 9

Lhoussine

Web Application Security Monitoring with OpenTelemetry

How to use OpenTelemetry traces as the foundation for application security monitoring — the same data your APM uses, repurposed for attack detection.

May 9

Lhoussine

Getting Started with SecureNow and Nuxt 3 — Add Security Monitoring in Under 2 Minutes

A hands-on walkthrough for adding security observability to a Nuxt 3 app using the securenow npm package and official Nuxt module. Covers installation, nuxt.config.ts setup, environment variables, optional tuning, deployment targets, CLI verification, and troubleshooting.

Apr 2

Lhoussine

One Flag to Trace Them All — `-r securenow/register` Now Works for ESM and CJS

Stop juggling --require and --import flags. securenow/register now auto-registers the ESM loader hook via module.register() on Node >=20.6, so a single -r flag is all you need for both CommonJS and ESM apps.

Apr 2

Lhoussine

Add Security Monitoring to a Next.js App with SecureNow — Traces, Logs, and Body Capture on AWS

Step-by-step guide to integrating SecureNow into a self-hosted Next.js application on AWS EC2. Covers installation, instrumentation, environment configuration, verifying traces and logs, enabling request body capture, and creating alert rules.

Mar 29

Lhoussine

How to Secure Your Fastify App with SecureNow — Real-Time API Protection via OpenTelemetry

Step-by-step guide to adding security monitoring to your Fastify API with the securenow npm package. Covers CLI setup, instrumentation, body capture caveats, PM2, Docker, and dashboard verification.

Mar 26

Lhoussine

How to Secure Your Feathers App with SecureNow — Full-Stack Service Monitoring

End-to-end guide for adding security monitoring to a Feathers.js application with SecureNow. Covers Express transport, service layer tracing, and production deployment.

Mar 26

Lhoussine

How to Secure Your h3 App with SecureNow — Nitro-Ready Observability Guide

Complete walkthrough for adding security monitoring to your h3 / Nitro application with the securenow npm package. Covers CLI setup, body capture, instrumentation, PM2, and Docker.

Mar 26

Lhoussine

How to Secure Your Hapi App with SecureNow — Full Integration Guide

Step-by-step guide to adding security monitoring and observability to your Hapi.js application using the securenow npm package. Covers CLI setup, instrumentation, PM2, and Docker.

Mar 26

Lhoussine

How to Secure Your Hono App with SecureNow — ESM-Ready Tracing for Modern Node.js

Complete walkthrough for adding security monitoring to a Hono application with SecureNow. Covers the ESM preload pattern, body capture limitations, and production deployment.

Mar 26

Lhoussine

How to Secure Your Koa App with SecureNow — Full-Stack Observability for Node.js APIs

Complete walkthrough for adding security monitoring to your Koa.js API with the securenow npm package. Covers CLI login, free trial setup, body capture, PM2 deployment, Docker, and trace verification.

Mar 26

Lhoussine

How to Secure Your Micro / Raw HTTP App with SecureNow — Zero-Framework Node.js Monitoring

Step-by-step guide to adding security monitoring to a raw Node.js HTTP server with SecureNow. No framework required — just http.createServer and one npm package.

Mar 26

Lhoussine

How to Secure Your NestJS App with SecureNow — TypeScript-Native Tracing and Threat Detection

End-to-end guide to adding security monitoring to your NestJS application using the securenow npm package. Covers instrument.js setup, TypeScript compatibility, PM2, Docker, and dashboard verification.

Mar 26

Lhoussine

How to Secure Your Polka App with SecureNow — Lightweight Framework Integration Guide

End-to-end guide for adding security monitoring to your Polka application with the securenow npm package. Covers body parsing, CLI setup, instrumentation, PM2, and Docker deployment.

Mar 26

Lhoussine

Getting Started with SecureNow and Express.js — From Install to Full Observability in 5 Minutes

A hands-on walkthrough for adding security monitoring to your Express.js app using the securenow npm package. Covers CLI login, app creation with the free trial, instrumentation, logging, and verifying traces in the dashboard.

Mar 24

Lhoussine

Getting Started with SecureNow and Next.js — Automatic Security Monitoring in Under 2 Minutes

Step-by-step guide to adding security observability to your Next.js application using the securenow npm package. Covers CLI authentication, free trial setup, automatic and manual instrumentation, Vercel deployment, and dashboard verification.

Mar 24

Lhoussine

Adding Security Observability to Your App in 15 Minutes with OpenTelemetry

A step-by-step developer guide to instrumenting your application with OpenTelemetry and connecting it to SecureNow for real-time security monitoring, threat detection, and AI-powered analysis.

Feb 9

security observability opentelemetry setup

Lhoussine

From Traces to Security Alerts: A Developer's Guide to Threat Detection

Learn how developers can set up security alerts on their applications without a dedicated SOC — detect 4xx spikes, error patterns, and suspicious IPs using trace-based alert rules.

Feb 7

Lhoussine

Writing Custom ClickHouse Queries for Application Security Analytics

A developer's tutorial on writing ClickHouse SQL queries for security analytics — find suspicious IPs, detect error patterns, and analyze application traffic using trace data.

Feb 5

clickhouse queries application security analytics

Lhoussine

The Complete SecureNow Workflow: From First Trace to Incident Resolution

A comprehensive walkthrough of the entire SecureNow platform — from application setup and trace ingestion through alert rules, AI investigation, forensic analysis, and incident resolution.

Feb 1

application security monitoring workflow

Lhoussine

How to Integrate SecureNow with Your Next.js Application

Complete guide to adding enterprise-grade security monitoring to your Next.js app with SecureNow. Learn automatic setup, manual configuration, and best practices for production deployment.

Dec 8

Lhoussine

How Tos & Tutorials

Features

Security