Next.js security checklist
A seven-item Next.js security checklist for App Router on Next.js 14 and 15: dependencies, validation, secrets, server-only code, headers, centralized checks, and editor or CI scanning.
Read guideWeb Security
Application & framework security guides
Checklists and implementation guides for securing Next.js, Remix, NestJS, login pages, containers, and self-hosted deployments.
What these guides cover
Application and framework security is the set of controls that live in the app you ship: headers, auth, logging, secret handling, container images, and the request handlers that accept untrusted input. A framework default is not a security review. Next.js, Remix, NestJS, and a Docker image each expose a different surface, but the jobs are the same: authenticate the caller, authorize the object, validate input, limit abuse, keep secrets out of the client bundle and the logs, and run the process as a non-root user on a current base image. These guides are checklists and worked examples for those jobs, not a substitute for object-level authorization in your own code.
Risks
- Framework defaults treated as a completed security review
- Secrets in client bundles, env files, or container images
- Self-hosted dashboards and login pages exposed to the public internet
- Stale base images, root containers, and missing request-path controls
Control priorities
- Framework security headers, auth, and input validation
- Bot detection, rate limits, and Shield in the request handler
- Secret scanning, structured logs, and a secrets manager
- Minimal images, non-root processes, and private admin networks
Recommended reading order
Start with the web app security checklist as the hub. Use the Next.js or Remix checklist for the framework you run, then the login-page, Docker, and logging guides for the surfaces you actually expose.
Guides in this collection
Remix security checklist
Security checklist for Remix v2 and React Router 7: module side effects, signed cookies, CSRF, headers, validation, uploads, and v1 @arcjet/remix or @arcjet/react-router screening.
Read guideWeb app security checklist
A production abuse checklist for Next.js, Remix, and Nuxt: bots, identity-aware rate limits, business-logic misuse, early rejection, monitoring, and in-handler controls.
Read guideHow to secure login pages
Secure login pages against brute force, credential stuffing, SQL injection, and session attacks with fixedWindow, detectBot allow lists, and HttpOnly cookies.
Read guideSecurity advice for self-hosting Next.js in Docker
Self-host Next.js in Docker on Node 22 LTS with standalone output, a non-root user, Distroless or slim runners, and secrets from a secrets manager.
Read guideHow to secure your NestJS application with Arcjet
Secure NestJS 10 and 11 with @arcjet/nest v1: ESM setup, ArcjetModule, ArcjetGuard, WithArcjetRules, and detectBot allow lists.
Read guideStructured logging in JSON for Next.js
Add structured JSON logging to Next.js 15 with Pino via the Instrumentation hook or next-logger v5. Use serverExternalPackages and log Arcjet decisions by ID.
Read guideProtecting self-hosted Coolify apps
Protect a self-hosted Coolify host with a Tailscale private network and UFW default-deny, then expose one app on purpose with Auth.js and in-app controls.
Read guideHow do I deploy an Arcjet-protected app to Fly.io?
Deploy Arcjet on Fly.io with v1 config, Fly-Client-IP detection, rate limiting, and bot protection. Set ARCJET_KEY as a Fly secret and verify denies.
Read guideHow do I secure a container deployment?
Secure Node.js containers with a non-root USER, Node 22 on current Debian, Distroless or Wolfi bases, a read-only root, secret scanning, and signed CI deploys.
Read guideWhy do TLS certificates fail in slim Node.js containers on OrbStack?
Fix OrbStack HTTPS in Node.js containers: slim images drop the OpenSSL CA store, so set NODE_OPTIONS=--use-openssl-ca and SSL_CERT_FILE to orbstack-root.crt.
Read guideHow do I detect the client IP on Firebase?
Get the real client IP on Firebase from x-fah-client-ip after FIREBASE_CONFIG platform detection. Do not maintain Google's published proxy list.
Read guideWhy do NEXT_PUBLIC_ variables leak into the Next.js client bundle?
NEXT_PUBLIC_ env vars are inlined into the browser bundle. Scan .vercel/output, .next, and Docker images with TruffleHog, Gitleaks, Trunk, and osv-scanner.
Read guideHow do I test Next.js App Router API routes?
Test App Router Route Handlers with next-test-api-route-handler and Vitest. Mock Auth.js v5 auth(), cover broken access control, and unit-test Arcjet-protected handlers.
Read guideHow do I functionally test security rules?
Test live Arcjet rules with Newman or k6 against the same binary you deploy. v1 config is key plus rules, with a 51-iteration rate-limit collection.
Read guide