A practical security checklist for shipping a Next.js app

Next.js makes it easy to ship an app in a weekend. It also makes it easy to ship a weekend's worth of security holes. This is the checklist we run through before calling a Next.js app production-ready.

Authentication & authorization

• →Every API route and Server Action verifies the session - and the user's role/ownership, not just that they're logged in.
• →Resource lookups are scoped to the current user (query by id AND userId) to prevent IDOR.
• →Return 404, not 403, for objects a user shouldn't see, so you don't leak their existence.

Secrets & configuration

• →No secrets in source. Server-only secrets never use the NEXT_PUBLIC_ prefix (that ships them to the browser).
• →.env.local is gitignored; production secrets live in your host's env store.
• →OAuth tokens and sensitive data are encrypted at rest.

Security headers

Set them in next.config. At minimum: a Content-Security-Policy, HSTS, X-Frame-Options (or frame-ancestors), X-Content-Type-Options, and a sensible Referrer-Policy. These are cheap and block whole classes of attacks.

Input handling

• →Validate and type-check request bodies (zod is a good default) - an object where you expected a string is how NoSQL operator injection happens.
• →Never build SQL by string concatenation; use parameterised queries.
• →Avoid dangerouslySetInnerHTML unless the input is sanitised.

Webhooks & external requests

• →Verify webhook signatures (e.g. Stripe) on every event - never trust an unsigned payload.
• →Validate any user-supplied URL you fetch server-side against an allow-list to prevent SSRF.

Dependencies & abuse

• →Keep dependencies patched; a known CVE in one package undoes everything else.
• →Rate-limit expensive or sensitive endpoints.

Verify it end-to-end

A checklist tells you what to look for; it doesn't tell you what you missed. Run a scan that reads the actual code - RedFlag will surface the specific routes, files, and lines where these rules are broken, ranked by how badly they can hurt you.