Hacker News Reader

I worked extensively with sails.js about three years ago and it was an unmitigated disaster. The ORM has about 1/8th of Rails' functionality and queries that would be trivial with Active Record were a nightmare. On top of that the community was a mess and around the end of that time, a lot of the core maintainers dropped out because there was so much in fighting.

Unless there have been some major changes I highly advise staying away from sails.js.

View on HN

It's been about four years since we touched it. When we used Waterline (the Sails ORM), we discovered two distinct SQL injection vulnerabilities in it, without intentionally looking. I would link the related issues, but they seem to have disabled Github issues in the waterline repository[1]. That--and lots more--scared us away. We switched happily to Hapi[2] with about a week of work and never looked back.

1. https://github.com/balderdashy/waterline

2. https://hapijs.com/

The major stable version came with a lot of improvements. I'm not saying sails.js is the best option for a big project, but is pretty decent for prototypes and fast development.

Reply on news.ycombinator.com