Next.js Secure BFF

Use this skill when Next.js acts as a public backend boundary, not just a rendering layer. Treat Route Handlers, Proxy, and Server Actions as externally reachable entry points that need normal backend security review.

When to Apply

Use this skill when:

• Writing or reviewing app/**/route.ts, proxy.ts, webhook handlers, callback URLs, or BFF proxy endpoints
• Designing Server Actions that mutate data or depend on authenticated users
• Moving database, secrets, or internal API access into a Next.js app
• Auditing whether data passed to Client Components is minimized and safe
• Debugging leaks through headers, serialized action results, logs, or broad DTOs

Load On Demand

Start with this file. Load detailed files only when the task needs them:

references/_sections.md
references/api-route-boundaries.md
references/security-server-action-authz.md
references/security-dal-dto.md
references/security-env-server-only.md
references/api-webhook-validation.md
references/api-proxy-headers.md
dataset/security/server-action-authz/correct.ts
sources/inventory.json

Each rule file includes:

• Why the pattern matters
• Incorrect and correct examples
• Dataset path with larger TypeScript/TSX examples
• Official source references

Rule Categories by Priority

Resolve conflicts by lower priority number first. At the same priority, prefer Security, API, then Operations.

Source Policy

Prefer official Next.js docs for framework semantics. For auth libraries, follow the library's official adapter docs after this skill establishes the Next.js security boundary. Do not copy community webhook, proxy, or Server Action snippets unless they validate inputs, re-authorize the caller, and filter outputs.