Before shipping a Next.js app, walk through this checklist—many incidents are env vars, cache surprises, or auth gaps rather than React bugs.
Security
- Secrets only in server env (no
NEXT_PUBLIC_leaks) - Authorize every Server Action and Route Handler
- Validate and sanitize all user input
- Secure cookies: httpOnly, secure, sameSite
Performance & UX
- Core Web Vitals on key templates
- Images sized and prioritized correctly
- Loading and error UI on slow/critical routes
- Metadata and OG tags on public pages
Operations
- Preview deployments and rollback plan
- Error and performance monitoring
- Documented env vars per environment
- Health checks if self-hosting Node
Self-check
- Which item on this list has burned you—or a team—before?
- How would you verify cache behavior after deploy?