validate-security

To audit Next.js Server Actions for authentication vulnerabilities, verify every server action explicitly uses 'use server', authenticates users via auth.api.getSession, and validates inputs with Zod schemas to enforce secure auth.

During a pre-merge code review for Next.js server actions, run security checks to verify user authentication, enforce resource ownership and authorization, and validate input data using Zod schemas across critical flows like checkout.

Schema validation with Zod secures server actions by enforcing strict input data structures before processing, preventing malformed or malicious payloads from reaching critical mutations and ensuring safe data flows during admin operations.

Yes, you can use this security audit for critical admin operations and checkout flows in Next.js by verifying resource ownership, enforcing access control permissions, and validating inputs prior to authorizing any data mutations.

The best way to enforce ownership and access control in Next.js Server Actions is to verify authenticated user permissions via auth.api.getSession and validate resource ownership before authorizing any mutations or sensitive operations.

Your Next.js server action fails security validation without explicit 'use server' and auth checks because the security baseline requires strict enforcement of server-side boundaries, user authentication via auth.api.getSession, and Zod schema validation.