Security for apps built with Next.js
Next.js puts your server and your client in one codebase, and turns shipping to production into a git push. That convenience is also where authorization and secret-handling mistakes slip in. Start with a free, passive snapshot of your external surface, then check what the outside view can't see.
The server and the client blur together
Next.js is powerful precisely because Server Components, Server Actions and Route Handlers sit right next to your client code. The risk is that the line between them is easy to cross by accident: a value meant for the server ends up in the browser bundle, or an endpoint that should confirm who is asking simply doesn't. It all builds and deploys cleanly, so nothing flags the gap.
The outside view can’t see this
Authorization in your Server Actions and route handlers
The costliest Next.js issues live in server code that runs without checking who is calling it: a Server Action or an API route that trusts an id from the request and returns or changes another user's data, or a page that renders sensitive data because the access check sits in the UI rather than on the server. None of it is visible from the outside, so a passive external check can't reach it. It needs the code read and the app tested, which is what a full review does.
What the free Surface Check covers for your Next.js app
- HTTPS and HSTS on your Vercel or custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers: whether your next.config headers() and middleware actually set Content-Security-Policy, clickjacking protection and nosniff.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on your session and auth cookies.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: keys that reached the browser bundle (a mis-scoped NEXT_PUBLIC_ variable, a Supabase service_role or Stripe secret key) in the front-end code you serve.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up. We record which domain was checked and keep anonymous result statistics; see our privacy policy.
Run the free Surface Check →Frequently asked
Does the check need access to my Next.js code or Vercel project?
No, it never signs in and never reads your server code. It reads what your domain shows the public internet, response headers, TLS, cookies, DNS and the client bundle your site already serves, and notes a Supabase or Firebase backend if it detects one, though it never queries it.
Isn't Next.js secure by default?
It gives you good defaults, but security depends on how you use Server Actions, route handlers and environment variables. A missing ownership check, or a secret exposed through a NEXT_PUBLIC_ variable, is your code rather than the framework's, and neither shows up as an error.
What is the most common Next.js issue you see?
A Server Action or API route that returns data without checking who is asking, and secrets that leaked into the client bundle. The free check flags what is visible externally; the access-control side needs a full review.
Is it free?
Yes, free and with no sign-up, with an A-to-F Surface Score and every issue scored by severity and fix effort.
More free checks
Go deeper than the free check on your Next.js app
A full Secvura Application Security Review is a hands-on assessment that reaches the inside risks an external check can’t: who can write or change your data, your storage and access-control logic, and the flaws that actually cost teams real money, with a clear plan your team can act on the same day.
£1,200
fixed price · report in 1–2 weeks · reply within one working day
Not ready? Start with the free Surface Check and see the quality of the findings first.