audit-nextjs-server-actions

What problem does it solve?

Many Next.js applications rely on Server Actions without proper authentication, input validation, or CSRF protection, creating attack surfaces where server endpoints can be called publicly or with insufficient checks.

Core Features & Use Cases

• Identifies server actions that run with 'use server' without authentication checks.
• Flags unvalidated inputs passed to database or external calls.
• Detects data over-fetching from server actions and missing cache invalidation patterns like revalidatePath.
• Provides actionable remediation steps and best-practice guidance for securing Next.js Server Actions in App Router.
• Use Case: A team auditing a Next.js app that uses server actions across pages to ensure only authenticated users can mutate data.

Quick Start

Review Next.js Server Actions and implement recommended security patterns (auth checks, input validation, error handling) to protect server endpoints.