Next.js Security Scan

Performs a defensive security review of a Next.js App Router project (Next.js 13+). Reports findings using the shared scoring schema.

Scope

Detects only — does not modify code. Targets:

• app/** — Server Components, Client Components, server actions, route handlers
• middleware.ts / middleware.js
• next.config.{js,ts,mjs}
• .env*

Out of scope: dependency CVEs (use npm audit / Snyk), runtime DAST.

Procedure