Next.js Security Posture

A React framework for server-side rendering and static site generation.

Next.js Security Overview

Next.js applications frequently expose sensitive environment variables if prefixed with NEXT_PUBLIC_ incorrectly. Additionally, custom security headers (like CSP and HSTS) are not enforced by default and must be explicitly configured in next.config.js.

Security Checks

Environment Variables (fail)

Variables starting with NEXT_PUBLIC_ are inlined into the client-side JavaScript bundle during the build process. Do not use this prefix for secrets.

Security Headers (warn)

Strict-Transport-Security (HSTS) and Content-Security-Policy (CSP) require manual configuration in next.config.js.

API Routes (warn)

API routes lack default rate limiting, making them vulnerable to basic enumeration or abuse without middleware.

Run a Security Audit

These technical checks are informational heuristics, not a guarantee of security or compliance. Passing a scan does not guarantee protection against zero-days or application logic flaws. Always conduct independent professional audits.