esbuild support for IAST in Node.js

content/en/security/code_security/iast/setup/nodejs.md

@@ -102,6 +102,71 @@ Update your ECS task definition JSON file, by adding this in the environment sec
 
 If you need additional assistance, contact [Datadog support][6].
 
+## Bundling with esbuild
+
+`dd-trace` provides esbuild support in the form of an esbuild plugin. Starting from `[email protected]`, this plugin also provides support for IAST product on CommonJS bundled applications.
+
+Here's an example of how one might use dd-trace with esbuild:
+
+```javascript
+// esbuild/esbuilder.js
+
+const ddPlugin = require('dd-trace/esbuild')
+const esbuild = require('esbuild')
+
+esbuild.build({
+  entryPoints: ['app.js'],
+  bundle: true,
+  outfile: 'out.js',
+  sourcemap: true, // required for correct vulnearability location
+  plugins: [ddPlugin],
+  platform: 'node', // allows built-in modules to be required
+  target: ['node18'],
+  external: [
+    '@datadog/native-iast-taint-tracking' // required for Datadog IAST features
+  ]
+}).catch((err) => {
+  console.error(err)
+  process.exit(1)
+})
+```
+
+To enable IAST when running the bundler, set the `DD_IAST_ENABLED` environment variable to `true`:
+
+```sh
+DD_IAST_ENABLED=true node esbuild/esbuilder.js
+```
+
+Because the tracer uses native modules, these must be included in the `external` list. Native modules used by `dd-trace` are provided in packages prefixed with `@datadog`. You must also distribute a `node_modules` directory alongside the bundled application.
+
+To generate a minimal `node_modules` directory containing only the required native modules and their dependencies:
+
+1. Determine the required package versions.
+
+2. Create a temporary directory for installation.
+
+3. Copy the resulting `node_modules` directory to the application's output directory.
+
+```sh
+cd path/to/project
+npm ls @datadog/native-iast-taint-tracking
+# [email protected]
+# └── @datadog/[email protected]
+mkdir temp && cd temp
+npm init -y
+npm install @datadog/[email protected]
+cp -R ./node_modules path/to/bundle
+```
+
+### Unsupported IAST features
+
+IAST support for bundled applications has some limitations, which are listed below:
+
+- Hardcoded password and Hardcoded secrets vulnerability detection
+
+- Security Controls feature
+
+
 ## Further Reading
 
 {{< partial name="whats-next/whats-next.html" >}}