How is the security of NodeJS backends compared to .Net or Java? Any libraries that would increase the security for an express app?

NodeJS definitely is viable for backends, even those large scale, and it always was.

There's also Deno, AFAIK (correct me) should also be fine.

I don't see any reason not to, especially if your team already has some experience with Node.js.

TL;DR Yes, use Node.js. The longer answer is _it depends_.

Here are some things to consider:

1. Existing Infrastructure and Expertise: Since you already have projects running on NextJS and Node.js, your team likely has expertise in JavaScript/Node.js. This familiarity can be a significant advantage in terms of development speed and ease of maintenance.

2. Cost-Effectiveness: Node.js developers are relatively abundant, which might help in finding talent within your budget constraints. Moreover, the JavaScript ecosystem is vast and has numerous free, open-source tools and libraries, which can be cost-effective for a startup.

3. Scalability: Node.js is known for its non-blocking I/O model, which can handle numerous simultaneous connections, making it a good fit for applications that need to support a large number of concurrent users. However, the scalability also depends on your application's architecture, database design, and other factors.

4. Performance: For IO-bound tasks, Node.js performs exceptionally well. However, for CPU-intensive tasks, it might not be the best choice. Since you are a startup aiming to scale from ~25K to ~100K users, Node.js can handle such traffic effectively, provided the application is well architected.

5. Ecosystem and Community Support: Node.js has a large and active community. This means a wealth of libraries, tools, and frameworks are available, along with strong community support for problem-solving.

6. Integration with Existing Projects: If your existing projects in Node.js and NextJS are functioning well and are expected to be part of the new project, using Node.js can ensure seamless integration.

Node.js is still a very relevant and viable option for production code, especially for a startup with existing Node.js and JavaScript expertise, looking for a cost-effective solution that scales well. It's essential to also consider the specific requirements of your project and possibly consult with your technical team or a software architect to make the best decision.

Thanks for the comments, gives me confidence

Yes would work just fine

No. Do not use JavaScript for backends. Use one of the holly three: Python, Go, Rust. Go or Python are probably the most optimal choices.