Built your Next.js app with Cursor or GitHub Copilot? AI assistants are great at writing features — but they consistently miss security configuration. Here's how to fix it in five steps.
Anay Pandya
379 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
GitHub Copilot, Cursor, and other AI assistants generate excellent Next.js boilerplate. What they consistently skip: security configuration. A fresh AI-generated Next.js app ships without security headers, without a Content Security Policy, with weak NextAuth settings, and with unaudited dependencies.
Is your site actually secure?
Run a free check — 60 seconds
Keep reading
const nextConfig = {
poweredByHeader: false,
async headers() {
return [{
source: "/(.*)",
headers: [
{ key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
{ key: "X-Frame-Options", value: "DENY" },
{ key: "X-Content-Type-Options", value: "nosniff" },
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
],
}];
},
};Every protected route needs authentication:
import { getServerSession } from "next-auth";
export async function GET() {
const session = await getServerSession(authOptions);
if (!session) return new Response("Unauthorized", { status: 401 });
}Add rate limiting on auth endpoints. Validate all input with Zod.
export const authOptions: AuthOptions = {
secret: process.env.NEXTAUTH_SECRET, // openssl rand -base64 32
useSecureCookies: process.env.NODE_ENV === "production",
cookies: {
sessionToken: {
options: { httpOnly: true, sameSite: "lax", secure: true },
},
},
callbacks: {
async redirect({ url, baseUrl }) {
if (url.startsWith(baseUrl)) return url;
if (url.startsWith("/")) return `${baseUrl}${url}`;
return baseUrl;
},
},
};Generate NEXTAUTH_SECRET with openssl rand -base64 32. Set NEXTAUTH_URL to your production domain in Vercel environment variables.
npm audit
npm audit fixFix all high and critical vulnerabilities before launch.
Deploy your app, then scan it at zeriflow.com/free-scan. A secured Next.js app should score above 75/100. The most common issues in AI-generated Next.js apps: missing CSP (73%), missing Permissions-Policy (68%), cookies without Secure flag (54%).
| What to secure | Where to configure | How to verify |
|---|---|---|
| Security headers | next.config.js headers() | ZeriFlow scan |
| Cookie flags | NextAuth options | ZeriFlow scan |
| API authentication | Each app/api/ route | Code review |
| Rate limiting | Middleware or per-route | Load test |
| Dependencies | npm audit | Snyk/Dependabot |
| Secrets | .env files only | git grep |
Verify your AI-generated app is production-ready.
80+ security checks in 60 seconds — free, no account needed.
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
May 12, 2026
Supabase Security Checklist Before Launch — RLS, Auth & API Keys
Monitor your security score
Schedule recurring scans and catch regressions after deployments.