clerk-nextjs-patterns
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides comprehensive security guidance for protecting Next.js resources, including Pages, Route Handlers, and Server Actions, using the
@clerk/nextjsSDK. - [SAFE]: Explicitly warns against common security pitfalls, such as failing to
await auth()(which could lead to undefined auth states) and missing resource-level checks. - [SAFE]: Includes a dedicated section on secure caching (
references/caching-auth.md) that emphasizes the criticality of includinguserIdororgIdin cache keys to prevent cross-user data leakage. - [SAFE]: Demonstrates correct implementation of defense-in-depth by recommending
auth.protect()at the individual resource level rather than relying solely on middleware, which protects against potential path normalization bypasses. - [SAFE]: Provides secure patterns for manual JWT verification in standalone API servers, highlighting the importance of verifying expiration (
exp) and not-before (nbf) claims.
Audit Metadata