Skip to content

next-secure-check v0.1.0

Choose a tag to compare

View all tags
@SetraTheXX SetraTheXX released this 20 May 23:37
· 86 commits to main since this release
v0.1.0
433b88a

next-secure-check v0.1.0

First public release of next-secure-check.

next-secure-check is a deterministic, rule-based static security scanner for Next.js projects. It helps catch common security mistakes before production, including leaked secrets, unsafe API routes, missing rate limits, weak configuration, XSS patterns, raw SQL usage, unsafe upload endpoints, and missing security headers.

This is a student-built learning project developed with an AI-assisted workflow, but the scanner itself does not use AI at runtime. All checks are deterministic and rule-based.

Highlights

  • CLI scanner published on npm
  • 20 built-in deterministic security rules
  • Terminal, JSON, Markdown, GitHub, and SARIF output
  • .next-secure-check.json config support
  • GitHub Actions friendly output
  • SARIF metadata, security severity, partial fingerprints, and concise messages
  • Safe public GitHub repository scan pipeline in the web demo
  • Server-side secret evidence redaction
  • Safe archive extraction with path traversal, symlink, hardlink, duplicate path, size, and cleanup protections
  • Optional GITHUB_TOKEN support
  • Optional Upstash Redis distributed scan guard
  • Timeout handling and safe logging
  • Committed .env.* variant coverage
  • Partial security header detection
  • 261 passing tests

Install

npm install -g next-secure-check
next-secure-check scan .

Or run without global install:

npx next-secure-check scan .

Example

npx next-secure-check scan . --format sarif --output report.sarif
npx next-secure-check scan . --fail-on high
npx next-secure-check scan . --exclude "**/*.test.ts,examples/**"

Published packages

  • next-secure-check
  • @next-secure-check/core
  • @next-secure-check/rules
  • @next-secure-check/reporter

Notes

Findings are review signals, not proof of exploitation. False positives and false negatives are possible, especially because v0.1 uses deterministic regex/lightweight-context rules rather than a full AST-based analysis engine.

Feedback, issues, and critical review are welcome.

Assets 2
Loading