Is Your Next.js App Safe? Check These 4 Things

Anyone could open this website and read 1.5 million secret keys. No hacking. No password. Just a browser.

Here's the real story behind the Moltbook database exposure, why the key in the browser wasn't the problem, and the 4 checks I run on every Next.js project.

THE 4 CHECKS 1. Search the code that reaches the browser for anything secret. 2. Never put NEXT_PUBLIC_ on a secret key. Keep secret keys on the server. 3. Turn on Row Level Security for every table. 4. Log out and try to read someone else's data.

Building with AI and want a person to check it before launch Message me: hemantinsights.com/contact?type=project

Dramatised true story. Characters are fictional stand-ins. The checks are general guidance. Wiz does not say which framework Moltbook used.

Sources: Wiz report: wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys Next.js environment variables: nextjs.org/docs/app/guides/environment-variables Supabase API keys: supabase.com/docs/guides/api/api-keys Supabase Row Level Security: supabase.com/docs/guides/database/postgres/row-level-security

Narration: Kokoro TTS (Apache-2.0). 3D animation, music and sound: original.