Next.js Data Security Review

Use the installed Next.js documentation as the API source of truth; this skill defines the review procedure and security invariants.

Review workflow

1. Resolve the installed next package from the affected app.
2. Read the relevant bundled guides for authentication, data security, Server Actions, Route Handlers, environment variables, caching, proxy behavior, and CSP.
3. Map every external entry point and trust boundary.
4. Trace sensitive data from request to storage, cache, logs, and client output.
5. Report findings with file evidence, impact, exploit path, and smallest safe remediation.

Required invariants