Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Next.js

Exposed .env files and debug endpoints in Next.js

criticalUpdated Oct 12, 2026

Delete debug routes or guard them so they cannot run in production. Prefer deleting them.

Fix for Next.js

Delete debug routes or guard them so they cannot run in production. Prefer deleting them. A health check returns status only.

Do not put .env in public/. Keep real env files gitignored. See keys committed to git.

If a secret was reachable, rotate it. Removing the route does not un-copy the value.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.