2026-10-22
A practical Next.js application audit: server actions, secrets, auth boundaries, and what not to put in the client bundle.
Client components can be rewritten in the browser. Authorization, price checks, and role checks have to run on the server or in the database. A hidden button is not access control.
Server Actions are public HTTP endpoints. Validate the input with Zod, check the session, and scope the query to the current user. Do not accept a user id from the form and trust it.
Only `NEXT_PUBLIC_` variables are allowed in the browser. Search the built output for service keys before the first deploy. Set security headers, and do not return raw database errors to the client.
Rate-limit anything that calls a model or sends email. An unbounded route is a bill, not a feature.
A useful Next.js audit lists reachable actions, which ones check a session, which queries run as the service role, and which environment variables are exposed. It is a backlog, not a score out of 100 with no evidence.