> How do you prevent supply chain compromises like this? Take a look at https://github.com/AikidoSec/safe-chain and https://intel.aikido.dev/?tab=malware! Disclaimer: I work at Aikido Security :)

Only install npm dependencies in a Docker container, e.g. dev containers offers an easy way to do that (the speed on macOS isn't great but hey)

Aikido scans all published npm packages in realtime: https://intel.aikido.dev/?tab=malware

Couple of thoughts:

Make it available through a web page instead of a raw search dump?

Hide the internals of your search engine? In case you want to switch to meilisearch, algolia, ... (for cost reasons)

Preferably use your own search DSL to avoid users to learn about Elasticsearch queries (goes hand in hand with hiding internals of search engine)

Good luck! :)

That'll all happen (though ES simple search expressions are quite OK). The reason it is the way it is today so to enable me to get it out into the world as fast as possible. It puts the M in MVP.

Why reinvent the wheel? It's a selling point that Elasticsearch queries can be used.

If he changes the engine he might as well implement the Elasticsearch language then for the new engine.

Reminds me of https://twitter.com/ircmaxell/status/984785734811963392