Shipping a Next.js app with Cursor, v0 or Bolt is fast, but speed hides flaws you do not see until someone finds them for you. This checklist covers the bare minimum before you hit deploy.
Environment variables: mind NEXT_PUBLIC
Anything starting with NEXT_PUBLIC_ is baked into the browser bundle. Anyone can read it by opening DevTools. Never put a private API key, a service token or your database secret there.
Reserve that prefix for genuinely public values, like your API URL or an analytics ID. Variables without the prefix live only on the server: use them for private keys and read them only from Server Components, API routes or Server Actions.
API routes: always validate and authorize
An API route is not private just because it sits in your folder. It is a public URL anyone can call with curl. Check the user session in every handler, not just in the UI. A hidden button does not stop someone hitting the endpoint directly.
Validate the request body before touching the database, and never trust the frontend to send clean data. An attacker writes their own frontend.
Security headers
By default Next.js sends no defensive headers. In next.config.js add at least Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options and a Content-Security-Policy. These cut down clickjacking, type sniffing and injected script execution.
Secrets leaking to the client
It is easy for a private key to end up in a Client Component by mistake, especially when AI rewrites files. Search your final bundle for strings like sk_, service_role or webhook URLs. If they show up in served JavaScript they are already compromised: rotate them and move them to the server.
Files that should not be reachable
Make sure .env, .git and backup files are not served in production. A .env reachable by URL is the most direct route to your database being emptied. Also check that package.json does not expose internal paths or dependencies that reveal your stack.
Check all of this in 30 seconds
Running this list by hand on every deploy is tedious and easy to forget. Scanaris runs read-only checks against your published site: headers, secrets exposed in the JavaScript, reachable sensitive files and cookie settings. Every finding comes with a prompt ready to paste into your AI so you fix it without guessing. Scan it before you announce your launch.