Next.js security: the flaws in AI-generated apps
Next.js is the framework AI tools generate the most, from v0 to Claude Code. It mixes server and client code in the same project: the line between what stays on the server and what goes to the browser is easy to cross by mistake.
Citadel knows the pitfalls specific to Next.js: public variables, server actions, image configuration, vulnerable framework versions.
Ten free analyses every month, no card needed. First report in minutes.
Analyse my app for freeThe most common flaws
Middleware bypass (CVE-2025-29927)
On affected versions, a single header skips the middleware that protects your pages.
Secrets in NEXT_PUBLIC_
Copied into the public JavaScript, so readable by anyone.
Source maps in production
Your full source code, comments included, becomes downloadable.
remotePatterns open to everyone
The image optimiser can be abused to make requests to any server.
What Citadel checks (15 live checks)
Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.
- Next.js version vulnerable to middleware bypass (CVE-2025-29927) A06 · CVE
- Secret exposed in a NEXT_PUBLIC_ variable CWE-200 · A02
- dangerouslySetInnerHTML fed with external data CWE-79 · A03
- Redirect built from URL parameters CWE-601 · A01
- images.remotePatterns open to every domain CWE-918 · A10
- Source maps published in production CWE-540 · A05
- child_process.exec or spawn with user input CWE-78 · A03
- eval, new Function or vm on external data CWE-95 · A03
- File path built from the request (path traversal) CWE-22 · A01
- JWT verified without an algorithm allow-list or with a weak secret CWE-347 · API2
- Session cookies without HttpOnly, Secure or SameSite CWE-1004 · CWE-614
- CORS: * origin combined with authentication cookies CWE-942 · A05
- Secrets in the code and config files (100+ key types) CWE-798 · A07
- npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
- Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
Frequently asked questions
Is my code kept?
No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.
How much does it cost?
The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.
Other guides
Vibe coding security: the checklist before you put your app online