this is what you have to go through if you want to get an api key for your gmail it somehow got worse

If you care about security for your NextJS app, stop using top level "use server" - it's way too easy to leak data

Top level "use server" creates endpoints for all exported functions, even if they are never used on the client

One accidental export can cause a ton of damage Pretty much all NextJS sites that I've seen which use actions have had some form of this vulnerability on them. I've yet to find a major security issue with this yet but imo it's a matter of time

Here's an example from Buildspace's sage site where it's leaking their AI prompt