Ship It Checklist

Checklists /Cursor or Claude Code, Next.js and Vercel /Security

High

Protect server actions and route handlers

A server action is a public POST, even if the button sits on a signed-in page. Agents often check the user in the layout and then trust the action. The action itself has to load the session and the ownership of the row.

How to check

  1. Search for 'use server' and for route.ts files.
  2. Each action that writes data should call your auth helper and return early when there is no user.
  3. Sign out and submit the action from the browser console or a replayed request. It should refuse.
  4. Pass another user's id. The update should not happen.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: every server action and route handler that mutates data checks the session and the row owner inside that function.

Steps:
1. Find "use server" functions and POST handlers.
2. Load the session inside each one. If it is missing, return an error or 401.
3. Do not take a user id from form data and trust it. Use the id from the session.
4. Leave the UI checks in place, but do not rely on them.
5. Explain one signed-out request that should fail.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes