sdcorejs-review-security-nextjs

What problem does it solve?

Prevents Next.js-specific security failures by detecting missing authentication, secret leakage, insecure headers, injection vectors, and unsafe redirects before shipping.

Core Features & Use Cases

• Cross-track baseline + Next.js checks: Runs review/security/shared.md first, then evaluates Next.js-specific risks like NEXT_PUBLIC_* leaks, Server Actions access control, and route handler auth.
• Frontend injection and policy validation: Flags unsanitized dangerouslySetInnerHTML, missing/weak Content-Security-Policy, and missing security response headers.
• Misconfiguration and abuse surface checks: Looks for middleware matcher gaps, overly broad next/image remotePatterns, open redirects, and contact-form spam/rate-limit handling.

Quick Start

Run the security review nextjs skill to audit a Next.js codebase and produce Critical/Important/Minor findings with OWASP mapping and grep evidence.