nextjs-ops
Warn
Audited by Socket on Sep 28, 2026
1 alert found:
SecuritySecuritytests/fixtures/app-sample/app/ui/widget.tsx
MEDIUMSecurityMEDIUM
tests/fixtures/app-sample/app/ui/widget.tsx
The code has a potential secret-exposure flaw: it sends STRIPE_SECRET_KEY to a client-rendered DOM attribute. The conflicting server-only import may make the framework reject the module, but the secret should not be referenced in client-rendered code. No clear malicious intent is evident.
Confidence: 97%Severity: 76%
Audit Metadata