Skip to content

Next.js Route Handler Audit

Audits route handlers for missing server-side validation, unbounded queries and leaked error detail.

promptDevelopment Next.js·EVEvalkit·v1.3·4.5 ★ (91)·3.7K runs·Updated 12d agoDemo item · example figures
Open in runner

When to use

  • Before shipping any handler that accepts client input. Reports by severity and never rewrites code unasked.

Prompt

Click a variable for its definition
Audit for: · input parsed without a schema · queries without a limit · error responses that echo internals · auth checks after side effects Report findings by severity. Do not rewrite code.

Variables

{{path}} *Route handler path or glob. · e.g. app/api/**/route.tstext

Input and output

Expected input
A path or glob.
Expected output
Severity-ranked findings.

Version history

  1. v1.32026-09-07 · evalkitCurrentAdded the auth-after-side-effect check.