---
title: "JSS deployment best practices and security"
slug: "jss-deployment-best-practices-and-security"
abstract: "DevOps best practices and recommendations"
---
# JSS deployment best practices and security

When developing with JSS, we recommend the following:

- Consider storing Sitecore back-end code and JSS site code in the same source control repository to avoid issues synchronizing changes between the front and back end, and enable developers to easily commit, test, and revert changes. This also makes it easy to build and deploy JSS site artifacts to Sitecore during CI builds.
- Automate the deployment of Sitecore updates and JSS site updates in headless mode into a single build process, to avoid defects caused by deploying different versions of the front end and back end.
- To enable storing JSS connection and deployment information in deployment variables, you can use several [options with the `jss setup` command](https://doc.sitecore.com/xp/en/developers/hd/22/sitecore-headless-development/sitecore-javascript-rendering-sdk-cli-tools-api-reference.html).

> [!tip]
> When running `jss` CLI commands in an environment where you cannot install global npm packages, you can use `npm run jss [command]` instead, which aliases the CLI command through `npm`.
>
> Use `--` before any arguments for the commands you run with `npm`. For example, `npm run jss deploy items -- --skipPackage`