If you care about security for your NextJS app, stop using top level "use server" - it's way too easy to leak data

Top level "use server" creates endpoints for all exported functions, even if they are never used on the client

One accidental export can cause a ton of damage Pretty much all NextJS sites that I've seen which use actions have had some form of this vulnerability on them. I've yet to find a major security issue with this yet but imo it's a matter of time

Here's an example from Buildspace's sage site where it's leaking their AI prompt