Review: Server Actions

Security Checklist

Input Validation

• All inputs validated with schema (zod, yup, etc.)
• Type coercion handled correctly (FormData.get returns strings)
• Length limits enforced
• No SQL injection vulnerabilities

For runtime validation patterns and type safety, use the using-runtime-checks skill from the typescript plugin.

If reviewing Zod schema validation patterns, use the validating-schema-basics skill for type-safe Zod v4 schema patterns.

Authentication & Authorization

• Session/auth checked before mutations
• User permissions verified
• Resource ownership validated
• No unauthorized access possible