Blog: What makes a node "certified" — Certified Nodes vs community nodes #5666

What

A standalone explainer on FlowFuse Certified Nodes: what "certified" actually means, how a node earns it, and what a certified node gives you that a random node off the Node-RED library doesn't.

Definitional, not an announcement. Two prior posts exist and neither does this job:

• What are Certified Nodes? (Oct 2023) — pre-dates the current program
• Certified Nodes 2.0 (Jul 2025) — aimed at node authors (partnership, revenue share), not at the people installing nodes

Why

"Just npm install it" is how most nodes get into production, and nobody audits what they pulled in. Sales and support both need one link that answers "why does this matter, the community node is free."

Outside writing on production Node-RED is already naming community nodes as a supply-chain risk (e.g. Wiring the Modern Stack with Node-RED). Our answer should be the thing that ranks.

TL;DR

Anyone can publish a Node-RED node. Certified Nodes are the ones we audit, keep auditing, and stand behind.

Cover

• How a node earns it: due diligence on popularity / maintenance / open-issue backlog → audit → team review before it enters the catalogue
• It's continuous, not a badge — a daily job re-audits every node and regenerates the catalogue.json that instances actually consume
• Vetted, accountable authors: real people we have a commercial relationship with, paid quarterly from the platform fee, on the hook for support
• CVEs patched on our timeline, not whenever an unpaid maintainer gets to it
• Hub (databases, brokers, APIs) vs Edge (OT protocols), and that both ship with the product
• Fair framing of the alternative — community nodes aren't bad, they're unowned. Certification is about who is accountable at 2am.

Refs: catalog.flowfuse.com · /certified-nodes · handbook process