Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Next.js

Firebase rules left open in Next.js

criticalUpdated Oct 12, 2026

If an Admin SDK service account is used on the server, rules do not apply to that SDK. Check the session in the Route Handler, the same as a Supabase secret key.

Fix for Next.js

If an Admin SDK service account is used on the server, rules do not apply to that SDK. Check the session in the Route Handler, the same as a Supabase secret key. Never import the service account into client code.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.