The App Router makes it easy to blur the line between server and client — and to ship a secret or an unguarded route without noticing. A real engineer reads your actual code and tells you what’s exposed.
● Read-only — we can't change, push or delete anything. Your code is never executed, and deleted after the audit.
Next.js failure modes cluster around the server/client boundary and what runs with full privileges. The build passes either way — these don’t show up until someone hits the endpoint directly.
Anything prefixed NEXT_PUBLIC_ is inlined into the browser bundle. So is any env var imported, even transitively, into a "use client" component. A Stripe, database or API secret on that path is public the moment you deploy.
check › Grep for NEXT_PUBLIC_ on anything not meant to be public, and check what your client components import.
An app/api/* route or a server action runs on the server with full privileges and is callable by anyone who knows the URL. Hiding the button in the UI does not protect it — each one needs its own authentication and authorization check.
check › Does every route handler and server action verify the session before doing work?
Middleware matchers are easy to misconfigure, and matched paths can slip through. Auth that lives only in middleware leaves a single point of failure — it belongs at the data-access layer too.
check › If middleware is the only gate, one wrong matcher = an open route.
Server actions feel like local function calls but accept arbitrary client input. Without validation and an ownership check they become an injection or IDOR path — editing a record by passing someone else’s id.
check › Are action inputs validated, and is the acting user authorized for that record?
Auth, signup and any third-party-cost endpoint are open to brute force and runaway billing when nothing throttles them.
check › Is there rate limiting on auth and on any endpoint that costs money to call?
These are the patterns, not a checklist run against your repo. The audit reads your actual Next.js code and tells you which of these are really there — prioritized, critical first. Or try the free 2-minute self-check →
The stack-specific bugs above are where we start. The review covers six areas in total, delivered as a prioritized report with an honest fix estimate for each.
One real engineer, a prioritized report within 48 hours, and a 15-minute call. $49, one-time.
Get your Next.js audit $49● Money-back guarantee · read-only · never executed · deleted after the audit
