BeforeMerge: Next.js Review

Comprehensive code review knowledge base for Next.js, React, and TypeScript applications. Contains rules across 4 categories — security, performance, architecture, and quality — prioritized by impact.

When to Apply

Reference these rules when:

Reviewing pull requests for Next.js/React/TypeScript projects
Writing new components, API routes, or server actions
Auditing existing code for security vulnerabilities
Refactoring code for performance or maintainability
Running pre-merge quality checks

Rule Categories by Priority

Priority	Category	Impact	Prefix	Focus
1	Security	CRITICAL	`sec-`	OWASP/CWE mapped anti-patterns
2	Performance	HIGH	`perf-`	Runtime and build-time optimization
3	Architecture	MEDIUM	`arch-`	Design patterns and code organization
4	Quality	LOW-MEDIUM	`qual-`	Maintainability and code health

How to Use

Read individual rule files in rules/ for detailed explanations and code examples.

Each rule contains:

Brief explanation of why it matters
Incorrect code example with explanation
Correct code example with explanation
CWE/OWASP mapping where applicable
References to official documentation

For the complete compiled guide: AGENTS.md

Next.js

Security(16)

Validate All Server Action Inputs at the Boundary

Performance(12)

Parallelize Independent Async Operations

Quality(4)

Never Hardcode Secrets — Use Environment Variables Properly

Architecture(3)

Break Up God Components Into Focused, Composable Units

Automate Next.js checks on every PR

Prevent Path Traversal in API Routes and File Operations

Never Rely Solely on Middleware for Authorization

Sanitize All HTML Before Using dangerouslySetInnerHTML

Authenticate Route Handlers Like Server Actions

Validate All Redirect URLs

Never Pass Secrets or Sensitive Data to Client Components

Authenticate Server Actions Like API Routes

Authenticate Server Actions Like API Routes

Never Build Database Queries with String Concatenation

Implement Rate Limiting on Sensitive Endpoints

Understand CSRF Limitations in Server Actions

Restrict CORS to Specific Allowed Origins

Validate File Uploads (Type, Size, Name, Content)

Prevent Cache Poisoning in ISR and SSR Routes

Set Secure Cookie Attributes (HttpOnly, Secure, SameSite)

Eliminate N+1 Database Queries

Use Dynamic Imports for Heavy Client Components

Use next/image Instead of Raw img Tags

Always Return Cleanup Functions from useEffect

Prefer Server Components Over Client Components

Prevent Unnecessary Re-renders from Unstable References

Prefer Server Components — Only Add 'use client' When Necessary

Avoid Barrel File Imports in Client Components

Avoid Stale Closure Bugs in Hooks and Callbacks

Use next/font Instead of External Font Loading

Use Stable, Unique Keys for List Items (Never Index)

Ban any at Trust Boundaries — Use unknown with Validation

Never Use Type Assertions on External Data — Validate Instead

Validate External Data at System Boundaries

Add Error Boundaries Around Unreliable Content

Implement loading.tsx and error.tsx at Every Route Segment

BeforeMerge: Next.js Review

When to Apply

Rule Categories by Priority

How to Use