new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Next.js · Guides · all subjects

data security & sanitization

9 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Password hashing before database storage

Before storing a user's password in the database, hash it using a library like bcrypt. For example, use bcrypt.hash(password, 10) to hash the password with a salt rounds value of 10.

Session payload should not contain PII or sensitive data

Session payload must not contain personally identifiable information like phone numbers, email addresses, credit card information, or sensitive data like passwords. Only include minimum unique user data such as user ID and role that will be used in subsequent requests.

Secret keys stored in environment variables

Secret keys should be stored in environment variables, but only the Data Access Layer should access process.env. This keeps secrets from being exposed to other parts of the application.

Server Components and Client Components security isolation

Server Components run only on the server and can safely access environment variables, secrets, databases, and internal APIs. Client Components run on the server during prerendering but must follow the same security assumptions as browser code and must not access privileged data or server-only modules. This isolated module system ensures the app is secure by default.

React Taint APIs for preventing data exposure

React provides two Taint APIs to prevent accidental exposure of private data to the client: experimental_taintObjectReference for data objects and experimental_taintUniqueValue for specific values. Enable usage in Next.js with the experimental.taint option in next.config.js set to true. Tainting prevents objects or values from being passed to the client but should be used as an additional layer alongside filtering and sanitizing data in the Data Access Layer.

server-only package for preventing client execution

Import 'server-only' at the top of modules to prevent server-only code from being executed on the client. This causes a build error if the module is imported in the client environment, ensuring proprietary code and internal business logic stay on the server. Next.js handles server-only imports internally; the NPM package can be installed to avoid linting issues.

NEXT_PUBLIC_ environment variables exposed to client

By default, environment variables are only available on the server. Next.js exposes any environment variable prefixed with NEXT_PUBLIC_ to the client. All other environment variables remain server-side only.

Control Server Action return values

Server Action return values are serialized and sent to the client. Only return what the UI needs, not raw database records. Avoid returning full database records that may include internal fields the client should not see.

Sanitize data before passing to Client Components

When passing data from Server Components to Client Components, sanitize the data first. Return only the public fields or necessary data the Client Component needs, not full database records that may contain sensitive information.

Give your agent this brain