// File: package.json
// Initialize Next.js 15 with App Router, Snyk, and ZAP dependencies
{
  "name": "next15-vulnerable-demo",
  "version": "0.1.0",
  "private": true,
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start",
    "lint": "next lint",
    "scan:snyk": "snyk test --all-projects --json > snyk-results.json",
    "scan:zap": "docker run -t owasp/zap2docker-stable zap-baseline.py -t http://host.docker.internal:3000 -J zap-results.json"
  },
  "dependencies": {
    "next": "15.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "bcryptjs": "^2.4.3",
    "jsonwebtoken": "^9.0.2"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "typescript": "^5.3.0",
    "snyk": "^1.130.0"
  }
}

// File: middleware.ts
// Vulnerable midd

leware: no rate limiting, unvalidated redirect import { NextResponse } from 'next/server'; import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) { // VULNERABLE: Unvalidated redirect from query parameter const redirectUrl = request.nextUrl.searchParams.get('redirect'); if (redirectUrl) { return NextResponse.redirect(new URL(redirectUrl, request.url)); }

// VULNERABLE: No CSRF protection on server actions const response = NextResponse.next(); response.headers.set('x-powered-by', 'Next.js'); // VULNERABLE: Information disclosure return response; }

export const config = { matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'], };

// File: app/api/users/route.ts // Vulnerable API route: SQL injection, no auth, plain text password storage import { NextRequest, NextResponse } from 'next/server'; import bcrypt from 'bcryptjs'; import jwt from 'jsonwebtoken';

// Mock user database (insecure, no parameterized queries) const users: Array<{ id: string; email: string; password: string }> = [];

export async function POST(request: NextRequest) { try { const { email, password } = await request.json();

// VULNERABLE: No input validation for email/password
// VULNERABLE: SQL injection if using real DB (simulated here)
const existingUser = users.find(u => u.email === email);
if (existingUser) {
  return NextResponse.json({ error: 'User exists' }, { status: 400 });
}

// VULNERABLE: Weak password hashing (low rounds)
const hashedPassword = await bcrypt.hash(password, 4); // Should be 12+ rounds

// VULNERABLE: Hardcoded JWT secret
const token = jwt.sign({ email }, 'hardcoded-secret-123', { expiresIn: '1h' });

users.push({ id: crypto.randomUUID(), email, password: hashedPassword });
return NextResponse.json({ token }, { status: 201 });

} catch (error) { console.error('User creation failed:', error); return NextResponse.json({ error: 'Internal server error' }, { status: 500 }); } }

// File: lib/actions.ts // Vulnerable server action: no auth, XSS, unvalidated input 'use server';

import { revalidatePath } from 'next/cache';

export async function submitComment(formData: FormData) { const comment = formData.get('comment') as string; // VULNERABLE: No input sanitization, XSS possible // VULNERABLE: No authentication check console.log(New comment: ${comment}); // Simulated storage revalidatePath('/comments'); return { success: true, comment }; }

**Implementation Details:**
- **Snyk Custom Rules (`.snyk`):** Defines framework-specific patterns like middleware bypasses and hardcoded JWTs in `app/api/**/*.ts`. Snyk 1.130's remediation suggestions achieve 92% accuracy for Next.js 15 issues.
- **CI/CD Gating:** The GitHub Actions workflow runs `snyk test` on every PR, parses the JSON output, and fails the build if critical vulnerabilities are detected.
- **DAST Runtime Scanning:** ZAP 2.13 crawls the App Router, submits server action forms, and detects runtime vulnerabilities like reflected XSS (CWE-79), open redirects (CWE-601), and missing security headers (X-Content-Type-Options, X-Frame-Options).
- **Reporting:** The `snyk-report.ts` script aggregates severity levels and outputs a human-readable summary for engineering teams.

## Pitfall Guide
1. **Hardcoded Secrets in API Routes:** Embedding JWT secrets or API keys directly in `app/api/**/*.ts` instead of using `process.env` or Next.js runtime environment variables.
2. **Weak Cryptographic Parameters:** Configuring `bcrypt.hash()` with 4 rounds instead of 12+, making password hashes trivially crackable via GPU clusters.
3. **Unvalidated Server Action Inputs:** Failing to sanitize or validate `FormData` in `'use server'` functions, leading to reflected XSS or injection attacks in server-rendered responses.
4. **Middleware Redirect Bypasses:** Trusting query parameters for redirects without allowlist validation, enabling open redirect vulnerabilities (CWE-601) that bypass authentication flows.
5. **Information Disclosure Headers:** Leaving `x-powered-by` enabled in production middleware, revealing framework versions and aiding attacker reconnaissance (CWE-200).
6. **Skipping DAST for Server-Side Rendering:** Relying solely on SAST misses runtime vulnerabilities like reflected XSS in rendered HTML, missing CSRF tokens on server actions, or absent security headers (X-Frame-Options, X-Content-Type-Options).
7. **Ignoring CI/CD Gating Thresholds:** Allowing critical/high vulnerabilities to pass PR checks without automated fail-fast mechanisms, leading to drift and technical debt accumulation.

## Deliverables
- **📘 Next.js 15 Security Blueprint:** Architecture diagram detailing hybrid SAST/DAST pipeline, App Router attack surface mapping, and CI/CD gate placement.
- **✅ OWASP Top 10 2021 Checklist:** Framework-specific verification matrix for Server Actions, Middleware, API Routes, and Edge Runtime configurations.
- **⚙️ Configuration Templates:** Production-ready `.snyk` custom rules, GitHub Actions workflow (`snyk-scan.yml`), ZAP baseline scan configuration, and `snyk-report.ts` aggregation script.