Nextjs Security Scan

Next.js Security Scan

Performs a defensive security review of a Next.js App Router project (Next.js 13+). Reports findings using the shared scoring schema.

Scope

Detects only — does not modify code. Targets:

• app/** — Server Components, Client Components, server actions, route handlers
• middleware.ts / middleware.js
• next.config.{js,ts,mjs}
• .env*

Out of scope: dependency CVEs (use npm audit / Snyk), runtime DAST.

Procedure

1. Enumerate target files via Glob/Grep. Read each one once with Read.
2. Apply each rule in the table below. For every match, record a finding with severity, location, evidence, and fix.
3. Emit the final report in the schema from SCORING.md.

Rules

Wrong vs. right

NEXTJS-ENV-001 (env leak)

// ❌ Exposes the API key to every browser bundle
const key = process.env.NEXT_PUBLIC_ANTHROPIC_API_KEY;

// ✅ Server-only access
// app/api/chat/route.ts
export async function POST(req: Request) {
  const key = process.env.ANTHROPIC_API_KEY;
  // ...
}

NEXTJS-SA-001 (unauth server action)

// ❌ Anyone who can hit the form can call this
"use server";
export async function deleteUser(id: string) {
  await db.user.delete({ where: { id } });
}

// ✅ Session-checked, schema-validated
"use server";
import { z } from "zod";
import { auth } from "@/auth";

const schema = z.object({ id: z.string().uuid() });

export async function deleteUser(input: unknown) {
  const session = await auth();
  if (!session?.user || session.user.role !== "admin") {
    throw new Error("Unauthorized");
  }
  const { id } = schema.parse(input);
  await db.user.delete({ where: { id } });
}

NEXTJS-RH-001 (CORS + credentials)

// ❌ Browsers will reject this in modern versions, but older clients won't
return new Response(data, {
  headers: {
    "Access-Control-Allow-Origin": "*",
    "Access-Control-Allow-Credentials": "true",
  },
});

// ✅ Origin allowlist
const ALLOWED = new Set(["https://app.example.com"]);
const origin = req.headers.get("origin") ?? "";
const allow = ALLOWED.has(origin) ? origin : "";
return new Response(data, {
  headers: {
    "Access-Control-Allow-Origin": allow,
    "Access-Control-Allow-Credentials": "true",
    "Vary": "Origin",
  },
});

References

• Next.js Server Actions: https://nextjs.org/docs/app/api-reference/functions/server-actions
• Next.js Middleware: https://nextjs.org/docs/app/building-your-application/routing/middleware
• Next.js Environment Variables: https://nextjs.org/docs/app/building-your-application/configuring/environment-variables
• OWASP CORS: https://owasp.org/www-community/attacks/CORS_OriginHeaderScrutiny