Next.js security audit for App Router apps
Next.js on Vercel ships fast — and often without production headers, tight CSP, or secret hygiene. Use this Next.js security audit before you share the production URL.
Supabase backend testing (optional)
Provide Supabase credentials to run deeper RLS and cross-tenant isolation probes. Secrets are encrypted at rest and never appear in scan reports.
Expand to add optional Supabase credentials.
Next.js security audit checklist
Enable HSTS and a tuned Content-Security-Policy on production
Set frame-ancestors / X-Frame-Options on auth and billing pages
Scan client bundles for leaked server secrets and NEXT_PUBLIC_ misuse
Ensure middleware and auth boundaries on dashboard routes
Verify metadata exports on dynamic [slug] marketing pages
Also check before launch
Core Web Vitals on mobile (LCP, CLS)
Organization or WebSite JSON-LD on the homepage
llms.txt and AI crawler access if you want citations
FAQ
Next.js security audit questions
How do I run a Next.js audit?
Deploy to your production (or shareable preview) URL and scan it with Launch Auditor. Prefer the exact hostname customers will use — preview headers and DNS often differ from production.
Does this cover App Router?
Yes. Launch Auditor crawls the live site regardless of Pages or App Router and flags headers, metadata, performance, and client-side secret exposure common on Vercel deploys.