mercado.clube67.com/tools/security-auditor/docs/framework-coverage.md

Framework Coverage Matrix

Next.js Pages Router

Inspect:

• pages/api/**
• pages/** forms that mutate state
• auth middleware or wrappers
• custom server or API helpers
• database and service layers under lib/, src/lib/, utils/

Common risks:

• missing input validation on req.body, req.query, req.cookies
• auth present in UI but absent in API route
• raw SQL, raw prisma calls, unsafe shell execution
• weak CORS or no rate limiting
• JWTs in browser storage

Next.js App Router

Inspect:

• app/api/**/route.*
• server actions and shared action helpers
• middleware.*
• route handlers for admin, billing, webhooks, exports, file upload
• dynamic segments and rewrite/proxy behavior

Common risks:

• authorization gaps in route handlers or server actions
• assuming middleware alone is sufficient for object-level authorization
• exposing secrets through NEXT_PUBLIC_*
• unsafe fetch() to user-controlled destinations on the server
• webhook endpoints without signature checks

React-only projects

Inspect:

• src/contexts, src/providers, auth hooks
• route guards and protected route components
• src/services, src/api, src/lib/api*, axios/fetch wrappers
• components rendering markdown/html/user content
• upload components, editors, and preview flows
• environment variable references in client code

Common risks:

• secrets bundled into client code
• tokens stored in localStorage
• assuming hidden buttons or client guards equal real authorization
• unsanitized HTML/markdown rendering
• insecure direct API calls to privileged endpoints

Shared code and monorepos

Inspect shared packages for:

• auth helpers
• db helpers
• ai clients and prompt builders
• logging utilities
• file and URL utilities

When shared code affects multiple apps, note the likely blast radius.