# Frequently asked questions

## Can Deno run a Node.js project directly?

Many projects can. Deno 2 supports `package.json`, npm packages, and a broad Node API surface, but native addons, loaders, install scripts, and edge APIs still need real tests. Use an [incremental migration](/en/docs/migration/from-node).

## Does running TypeScript type-check it automatically?

Do not depend on that assumption. Execution emphasizes fast transpilation and startup; run `deno check` explicitly in CI.

## Does secure-by-default make arbitrary untrusted code safe?

No. Permissions reduce default I/O, but code on one thread shares grants. `--allow-run`, FFI, resource exhaustion, and runtime vulnerabilities require OS or container isolation. Read [Permission boundaries](/en/docs/core/permissions).

## Should I use JSR or npm?

Follow the repository convention first. Check JSR for TypeScript-native packages and the standard library; use npm for mature Node packages. Decide from maintenance, compatibility, licensing, and supply-chain constraints.

## Does `deno.json` replace `package.json`?

It can be standalone or coexist. Deno configuration owns tasks, imports, workspace, and tool settings; migrated projects can retain npm metadata and scripts in `package.json`.

## Is Deno production-ready?

Yes, but a runtime does not supply pinning, least privilege, logs, health checks, capacity, secrets, rollback, or platform verification for you. Apply the [production baseline](/en/docs/deploy/production-baseline).