Next.js security checklist
Seven-item App Router checklist: dependencies, validation, secrets, server-only code, headers, centralized checks, and CI scanning.
Read guideWeb Security
Application & framework security guides
Checklists and implementation guides for securing Next.js, Remix, NestJS, login pages, containers, and self-hosted deployments.
What these guides cover
Application and framework security is the set of controls that live in the app you ship: headers, auth, logging, secret handling, container images, and the request handlers that accept untrusted input. A framework default is not a security review. Next.js, Remix, NestJS, and a Docker image each expose a different surface, but the jobs are the same: authenticate the caller, authorize the object, validate input, limit abuse, keep secrets out of the client bundle and the logs, and run the process as a non-root user on a current base image. These guides are checklists and worked examples for those jobs, not a substitute for object-level authorization in your own code.
Risks
- Framework defaults treated as a completed security review
- Secrets in client bundles, env files, or container images
- Self-hosted dashboards and login pages exposed to the public internet
- Stale base images, root containers, and missing request-path controls
Control priorities
- Framework security headers, auth, and input validation
- Bot detection, rate limits, and Shield in the request handler
- Secret scanning, structured logs, and a secrets manager
- Minimal images, non-root processes, and private admin networks
Recommended reading order
Start with the web app security checklist as the hub. Use the Next.js or Remix checklist for the framework you run, then the login-page, Docker, and logging guides for the surfaces you actually expose. AI agent frameworks have their own security guides under AI Security.
Guides in this collection
Remix security checklist
Remix v2 and React Router 7: module side effects, signed cookies, CSRF, headers, validation, and uploads.
Read guideWeb app security checklist
A practical web app checklist: auth, input validation, secrets, headers, dependency risk, and in-app controls.
Read guideHow to secure login pages
Plan for four threats: brute force, credential stuffing, SQL injection, and session theft.
Read guideSecurity advice for self-hosting Next.js in Docker
Pin node:22-bookworm for builds and node:22-bookworm-slim or gcr.io/distroless/nodejs22-debian13:nonroot for the runner.
How to secure your NestJS application with Arcjet
Secure NestJS 10 and 11 with @arcjet/nest v1.
Read guideStructured logging in JSON for Next.js
Add structured JSON logging to Next.js 15 with Pino via the Instrumentation hook or next-logger v5.
Read guideProtecting self-hosted Coolify apps
Install Tailscale first, deny inbound except tailscale0, then install Coolify on the tailnet.
How do I deploy an Arcjet-protected app to Fly.io?
Deploy Arcjet on Fly.io with v1 config, Fly-Client-IP detection, rate limiting, and bot protection.
Read guideHow do I secure a container deployment?
Secure Node.js containers with a non-root USER, Node 22 on current Debian, Distroless or Wolfi bases, a read-only root, secret scanning, and.
Read guideWhy do TLS certificates fail in slim Node.js containers on OrbStack?
Node.js trusts a frozen Mozilla CA snapshot, not OrbStack's local CA.
Read guideHow do I detect the client IP on Firebase?
Get the real client IP on Firebase from x-fah-client-ip after FIREBASE_CONFIG platform detection.
Read guideWhy do NEXT_PUBLIC_ variables leak into the Next.js client bundle?
NEXT_PUBLIC_ env vars are inlined into the browser bundle.
Read guideHow do I test Next.js App Router API routes?
Test Next.js API routes for auth gaps, abuse paths, and Arcjet decisions without flaky end-to-end suites.
Read guideHow do I functionally test security rules?
Test live Arcjet rules with Newman or k6 against the same binary you deploy.
Read guide