Security for apps built with Next.js
Next.js puts your server and your client in one codebase, and turns shipping to production into a git push. That convenience is also where authorization and secret-handling mistakes slip in. Start with a free, passive snapshot of your external surface, then check what the outside view can't see.
The server and the client blur together
Next.js is powerful precisely because Server Components, Server Actions and Route Handlers sit right next to your client code. The risk is that the line between them is easy to cross by accident: a value meant for the server ends up in the browser bundle, or an endpoint that should confirm who is asking simply doesn't. It all builds and deploys cleanly, so nothing flags the gap.
The outside view can’t see this
Authorization in your Server Actions and route handlers
The costliest Next.js issues live in server code that runs without checking who is calling it: a Server Action or an API route that trusts an id from the request and returns or changes another user's data, or a page that renders sensitive data because the access check sits in the UI rather than on the server. None of it is visible from the outside, so a passive external check can't reach it. It needs the code read and the app tested, which is what a full review does.
What the free Surface Check covers for your Next.js app
- HTTPS and HSTS on your Vercel or custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers: whether your next.config headers() and middleware actually set Content-Security-Policy, clickjacking protection and nosniff.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on your session and auth cookies.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: keys that reached the browser bundle (a mis-scoped NEXT_PUBLIC_ variable, a Supabase service_role or Stripe secret key) in the front-end code you serve.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up, and nothing is stored.
Run the free Surface Check →Frequently asked
Does the check need access to my Next.js code or Vercel project?
No. It is passive and reads only what your domain shows the public internet: response headers, TLS, cookies and DNS, plus the client bundle your site already serves. It never signs in and never reads your server code.
Isn't Next.js secure by default?
It gives you good defaults, but security depends on how you use Server Actions, route handlers and environment variables. A missing ownership check, or a secret exposed through a NEXT_PUBLIC_ variable, is your code rather than the framework's, and neither shows up as an error.
What is the most common Next.js issue you see?
A Server Action or API route that returns data without checking who is asking, and secrets that leaked into the client bundle. The free check flags what is visible externally; the access-control side needs a full review.
Is it free?
Yes, free and with no sign-up, with an A-to-F Surface Score and every issue scored by severity and fix effort.
More free checks