id: JS-SEC-045
name: nextjs-ssr-secrets
severity: high
language: javascript
cwe: CWE-200
owasp: "A05:2021"
description: "Detect Next.js patterns that may expose server-side secrets to the client bundle."
pattern:
  type: regex
  regex:
    - 'NEXT_PUBLIC_.*SECRET'
    - 'NEXT_PUBLIC_.*PASSWORD'
    - 'NEXT_PUBLIC_.*API_KEY'
message: "Server-side secrets may be exposed to the client in Next.js. NEXT_PUBLIC_ variables are bundled into client code."
fix_hint: "Never prefix secrets with NEXT_PUBLIC_. Use server-only environment variables and access them only in getServerSideProps, API routes, or server components."
references:
  - https://cwe.mitre.org/data/definitions/200.html
  - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/
