Security Nextjs

A focused Next.js security auditor that catches the stuff that's easy to miss in App Router projects. It hunts for the classic NEXT_PUBLIC_ footgun where secrets end up in client bundles, checks Server Actions for missing auth and input validation, and verifies middleware matchers actually cover your protected routes. The pattern library is solid on the specifics: IDOR vulnerabilities in dynamic routes, the next.config.js env trap, inconsistent auth between API route methods. Use it when reviewing Next.js codebases or before deployment to catch high severity auth gaps. The grep commands alone make it worth having loaded if you work in Next.js regularly.

skills.sh installs: 370
GitHub stars: 122
last updated: Jun 3, 2026

View on GitHub

Install

$ npx -y skills add igorwarzocha/opencode-workflows --skill security-nextjs --agent claude-code

Installs into .claude/skills of the current project.

Files

Security audit patterns for Next.js applications covering environment variable exposure, Server Actions, middleware auth, API routes, and App Router security.

Environment Variable Exposure

The NEXT_PUBLIC_ Footgun

NEXT_PUBLIC_* → Bundled into client JavaScript → Visible to everyone
No prefix     → Server-only → Safe for secrets

Audit steps:

grep -r "NEXT_PUBLIC_" . -g "*.env*"
For each var, ask: "Would I be OK if this was in view-source?"
Common mistakes:
- NEXT_PUBLIC_API_KEY (SHOULD be server-only)
- NEXT_PUBLIC_DATABASE_URL (MUST NOT use)
- NEXT_PUBLIC_STRIPE_SECRET_KEY (use STRIPE_SECRET_KEY)

Safe pattern:

// Server-only (API route, Server Component, Server Action)
const apiKey = process.env.API_KEY; // ✓ No NEXT_PUBLIC_

// Client-safe (truly public)
const publishableKey = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY; // ✓ Publishable