Least-privilege security framework for Node.js