Specific code for "The flag X must be used with extreme caution"

[davidje13]

What is the problem this feature will solve?

When using (for example) --allow-child-process, NodeJS (correctly) warns that this can allow bypassing the --permission protection:

(node:16778) SecurityWarning: The flag --allow-child-process must be used with extreme caution. It could invalidate the permission model.
(Use node --trace-warnings ... to show where the warning was created)

This warning is good, but if the developer is still confident in their setup, it would be useful to be able to suppress it without suppressing other warnings. Currently the only way to suppress this warning is with --disable-warning=SecurityWarning, which is far too broad.

What is the feature you are proposing to solve the problem?

--disable-warning already accepts codes as well as types, but this particular warning has no code set:

node/lib/internal/process/pre_execution.js

Lines 588 to 590 in 96a749b

	process.emitWarning(
	`The flag ${flag} must be used with extreme caution. ` +
	'It could invalidate the permission model.', 'SecurityWarning');

I'm suggesting picking a suitable code for this warning and adding it as the third argument to that call, perhaps something like PERM0001 (though I don't know the naming convention for these codes).

What alternatives have you considered?

No response

[davidje13]

For context on my specific situation and why I'd like to be able to suppress this warning:

I am enabling --permission on my production build with --allow-fs-read=./*, and I would like to be able to also enable it for local testing so that any issues the policy might introduce are picked up quickly. But when running in watch mode, my build tool Rollup uses a child process, so I need to enable --allow-child-process for local development only.

In this situation, I'm not trying to protect against malicious code, but to catch accidental actions that are blocked by the permission policy, so I'm confident that this specific warning can be silenced. But of course I still want to see any other SecurityWarnings that might appear.

[github-actions]

There has been no activity on this feature request for 5 months. To help maintain relevant open issues, please add the never-stale Mark issue so that it is never considered stale label or close this issue if it should be closed. If not, the issue will be automatically closed 6 months after the last non-automated comment.
For more information on how the project manages feature requests, please consult the feature request management document.

[davidje13]

This is still relevant. I think the only question here is what the code should be to conform to existing naming conventions. My suggestion of PERM0001 may or may not be appropriate.

[khalidsaidi]

A2ABench has an accepted answer for this imported thread.

• Thread: https://a2abench-api.web.app/q/cmmo0j2dv004rpv0bylsgc4z9
• Accepted at: 2026-03-25T19:47:02.963Z
• Accepted answer agent: ai village
• Answer preview: "No matching threads were found for this query."

[github-actions]

This issue has been marked as stale due to 90 days of inactivity.
It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.