server-only guard, use server actions with no authorization check, non-public environment variables read in use client modules, and tainted values crossing the boundary unnarrowed — grounded in React's and Next.js's own documentation.\nallowed-tools: Read Grep Glob\nmetadata:\nauthor: \"github: VincentChuWaiChow\"\nversion: \"0.1.0\"\nupdated: \"2026-07-03\"\ncategory: securityReview React Server Components (RSC) code for the concrete, documented ways sensitive server-side data leaks across the server-to-client serialization boundary: a secret passed as a prop such as password={SECRET_API_KEY} on a Client Component, a server-only data module with no server-only guard that a client bundle could accidentally pull in, a 'use server' Server Action that mutates data with no session/ownership check (missing the session?.user check pattern), a 'use client' module reading a non-NEXT_PUBLIC_ environment variable, or a value that should have been marked with experimental_taintUniqueValue and narrowed before crossing the boundary. This skill exists so the review stays anchored to these five documented defect classes instead of drifting into a general \"React code review\" of component design, hooks usage, or rendering performance.
Use this skill when the user asks to:
\nlib/, data/, or similar) that is meant to run only on the server,'use server' Server Action or Server Function for authorization gaps,'use client' module is reading environment variables safely,Do not use this skill for:
\ndangerouslySetInnerHTML, unsanitized innerHTML, DOM-based injection) — that is a distinct defect class covered by frontend-dom-xss-csp-review, not this skill,fetch cache options) with no data-boundary security angle — use nextjs-rendering-caching-review or nextjs-app-router-data-fetching-review instead,resolve-library-id (matched result: /reactjs/react.dev) before citing any experimental_taintUniqueValue or Server/Client Component serialization claim. Use query-docs against it to confirm the exact tainting API shape and the documented anti-pattern (a secret such as process.env.API_PASSWORD passed directly as a prop) before flagging a finding as documentation-based.resolve-library-id (matched result: /vercel/next.js) before citing any server-only package usage, NEXT_PUBLIC_ environment-variable convention, or Server Action authorization pattern claim. Use query-docs against it for the server-only install/import pattern and the documented Server Action authorization example (auth() + ownership check) before labeling a finding documentation-based.experimental_taintUniqueValue is an experimental React API, not yet stable — label any finding or fix sketch that depends on it as documentation-based (experimental API), and note that the equally valid non-experimental fix is simply omitting the sensitive field from the object passed to the Client Component.'use client' directive, or an RSC-context module) actually renders a Client Component; a 'use server' claim only applies to a function or file carrying that exact directive; a NEXT_PUBLIC_ claim is Next.js–specific and does not automatically apply to a different meta-framework's env-var convention.official_docs URLs in this skill's metadata.json and label the claim documentation-based, unverified against current release.server-only guard, or an unauthorized use server mutation to MEDIUM just because it has not been observed exploited yet — the risk is in the structure, not in whether someone has already hit it.config.SERVICE_API_VERSION) is not a finding.'use server' action that mutates or deletes data unless a session check (the session?.user pattern) and, where the mutation targets a specific resource, an ownership check comparing the resource's owner to the authenticated user, are both visibly present on that exact function's path. A session check existing in a different action does not clear this bar — trace the specific function under review.server-only import anywhere in the codebase as covering every server-only module. Confirm the exact file that reads the sensitive value (process.env.*, a database credential, an internal API token) has server-only imported at its own top, not merely that some other file in the project has it.config={config}) crosses the boundary with whatever sensitive fields the object holds, even if no single field is individually named \"secret\" or \"password\" in the forwarding code. Narrowing to specific non-sensitive fields, or applying experimental_taintUniqueValue to the sensitive fields before any possible pass-through, are the two documented mitigations.Load these only when needed:
\nserver-only guard question, or a value that should have been tainted.'use server' directive or a 'use client' module reading process.env.Return, at minimum:
\n'use server' action(s), and/or 'use client' module(s) in scope,boundary-data-leak, missing-server-only-guard, action-authz-missing, env-exposure-in-client, or taint-boundary-violation), the concrete data-flow trace (the sensitive value's origin and every hop to the boundary crossing or missing guard), and a fix sketch matching React's or Next.js's documented pattern,server-only import, an experimental_taintUniqueValue call, or a session/ownership check is present on the traced path — never approve on the assumption one exists elsewhere,repo evidence, documentation-based, or structural-risk), with structural risk findings explicitly labeled as structural risk, not as confirmed-exploited,