When you audit a Next.js app, start with the data layer, then read every use client and use server file, then the dynamic route folders, then the proxy and route handlers. The official data security guide lists these as the places to spend extra time.
1. The data access layer
Is there an isolated, server-only layer for reading and writing data? The guide says to verify that database packages and environment variables are not imported outside it. If data access is scattered through components, you are auditing every file instead of one.
2. The use client files
Client components run with browser level trust. Ask: do the props expect private data, and are the type signatures broader than needed? A component that takes a whole user record is a flag even if it only renders the name today.
3. The use server files
The guide asks several specific questions:
- Are action arguments validated inside the action or the data layer?
- Is the user re-authorized inside the action?
- Does the action check ownership of the resource, not just that someone is logged in?
- Are return values filtered to what the client needs?
- Is database access delegated to a server-only layer?
Each "no" is a finding.
4. Folders with brackets
Segments like [id] are user input. The guide says to check whether params are validated before use in queries, file paths or redirects.
5. The proxy file and route handlers
The guide says the proxy file and route.ts handlers have a lot of power and deserve extra time using traditional techniques. It also recommends penetration testing or vulnerability scanning regularly, in line with your development lifecycle.
6. The dependency tree
The official guide covers application code. Framework versions and packages matter as well, because an advisory in next itself is outside anything your own code review will find. Safeguard's SBOM and dependency scanning can list what you ship and which known vulnerabilities apply, and a free scan is at gold.safeguard.sh/scan.
A one page worksheet
- Data layer: Are secrets and DB clients only here?
- use client: Are props narrow?
- use server: Auth, ownership, validation, return shape?
- Params: Validated?
- Route handlers: Reviewed like any API?
- Dependencies: Framework patched?
Quick check
Where should I start if I only have an hour?
Read the use server files and confirm each one checks authentication and ownership inside the action.
Is this enough for a full security review?
No. It is the Next.js specific starting list. Add your usual API, authentication and infrastructure review.
Sources
Last reviewed: 19 October 2026.
