Security in JavaScript

node-security.js

var customRequest;
(function () {
    function CustomRequestModule () {
        function isSafeUrl (url) {
            return url === 'https://safe-site.com';
        }

        function getAccessToken () {
            return 'my top secret access token';
        }

        return {
            post: function (params, callback) {
                var paramsToSend = JSON.parse(JSON.stringify(params)); // copy the JSON
                if (isSafeUrl(paramsToSend.url)) {
                    paramsToSend.headers.Authorization = 'token ' + getAccessToken();
                }
                request(paramsToSend, callback);
            }
        }
    };
    customRequest = new CustomRequestModule();
})();

require('./your-custom-module.js')(customRequest);

And put the secret token in a variable that is outside the closure so if you cast the closured function to a string all it outputs is the variable name.