majiayu000 Review: Server Actions
Security Checklist
Input Validation
- All inputs validated with schema (zod, yup, etc.)
- Type coercion handled correctly (FormData.get returns strings)
- Length limits enforced
- No SQL injection vulnerabilities
For runtime validation patterns and type safety, use the using-runtime-checks skill from the typescript plugin.
If reviewing Zod schema validation patterns, use the validating-schema-basics skill for type-safe Zod v4 schema patterns.
Authentication & Authorization
- Session/auth checked before mutations
- User permissions verified
- Resource ownership validated
- No unauthorized access possible
For secure credential handling, use the SECURITY-credentials skill from the typescript plugin.
Data Sanitization
- User input sanitized before storage
- No XSS vulnerabilities
- File uploads validated (type, size, content)
- Dangerous operations require confirmation
Best Practices
Error Handling
- Try-catch blocks for async operations
- Specific error messages for users
- No sensitive data in error messages
- Logging for debugging
Return Values
- Return serializable objects only
- Consistent response format
- Success and error states handled
- Field-specific errors when needed
Performance
- Database queries optimized
- No N+1 query problems
- Appropriate use of transactions
- Rate limiting where needed
Anti-Patterns to Flag
- ❌ No validation (trusting client input)
- ❌ No authentication checks
- ❌ Returning non-serializable values (functions, classes)
- ❌ Missing error handling
- ❌ Exposing sensitive data
- ❌ Direct database queries without sanitization
- ❌ No rate limiting on critical actions
For comprehensive Server Actions security, see: research/react-19-comprehensive.md lines 723-729, 1808-1942.