A developer deploys a Node.js application as root (uid=0) on a Linux server. Why is this a critical security mistake?

• A.Running as root means that if the application is compromised (e.g., via RCE vulnerability), the attacker gains root access to the entire server - they can read all files, install backdoors, escalate to other systems, and perform any OS operation. Applications should run with a dedicated low-privilege user account
• B.Running as root lets the Node.js process bind ports below 1024 (443, 80) directly, which is the intended design, but it also makes npm install scripts run with full privileges, so a malicious package gains the right to modify the kernel modules of the server and read all environment variables of other users during each deployment
• C.Root is dangerous because the V8 engine disables its sandbox when the uid is 0 (a documented flag), so any JavaScript in a request handler can call native syscalls, and the attacker gains the whole host without needing an RCE bug in the application code itself, only a crafted payload sent to the public port on the host