security-nextjs

To scan a Next.js application for security vulnerabilities, run the provided security script which uses ripgrep to pattern-match project files. It identifies environment variable exposure, unauthenticated Server Actions, and insecure middleware configurations.

To check a Next.js app for exposed environment variables, scan for accidental secret exposure via the NEXT_PUBLIC_ prefix or insecure next.config.js env settings. The script detects these risks to prevent data leaks before deployment.

Yes, this Next.js security audit covers Server Actions and API routes. It specifically checks for missing authentication and input validation within these endpoints to prevent unauthorized access to your application logic.

The best way to secure Next.js middleware configurations is to review middleware.ts for adequate matchers and proper authentication enforcement. The scan identifies inadequate route matching to ensure access controls function correctly.

Yes, you can use this vulnerability scanning tool with an existing Next.js App Router project. It analyzes your current directory structure and files to pinpoint security flaws without requiring additional dependencies.