I would like to add the following topics as what you shouldn't do in production: Serve static assets not minified and gzip'ed (see grunt) Disallow local caching for those static assets Keep access logging enabled Store uploaded files on disk folders instead of a virtual file system like GridFS