on The architecture leverages a hybrid SAST/DAST pipeline with Next.js 15-specific custom rules. Snyk 1.130 handles static analysis of dependencies, hardcoded secrets, and server action patterns, while OWASP ZAP 2.13 performs baseline DAST scanning against the running App Router to catch runtime XSS, open redirects, and missing security headers. The pipeline is gated in GitHub Actions to fail builds on critical findings.

// File: package.json
// Initialize Next.js 15 with App Router, Snyk, and ZAP dependencies
{
  "name": "next15-vulnerable-demo",
  "version": "0.1.0",
  "private": true,
  "scripts": {
    "dev": "next dev",
    "build": "next build",
    "start": "next start",
    "lint": "next lint",
    "scan:snyk": "snyk test --all-projects --json > snyk-results.json",
    "scan:zap": "docker run -t owasp/zap2docker-stable zap-baseline.py -t http://host.docker.internal:3000 -J zap-results.json"
  },
  "dependencies": {
    "next": "15.0.0",
    "react": "^19.0.0",
    "react-dom": "^19.0.0",
    "bcryptjs": "^2.4.3",
    "jsonwebtoken": "^9.0.2"
  },
  "devDependencies": {
    "@types/node": "^20.10.0",
    "@types/react": "^19.0.0",
    "@types/react-dom": "^19.0.0",
    "typescript": "^5.3.0",
    "snyk": "^1.130.0"
  }
}

// File: middleware.ts
// Vulnerable middleware: no rate limiting, unvalidated redirect
import { NextResponse } from 'next/server';
import type { NextRequest } from 'next/server';

export function middleware(request: NextRequest) {
  // VULNERABLE: Unvalidated redirect from query parameter
  const redirectUrl = request.nextUrl.searchParams.get('redirect');
  if (redirectUrl) {
    return NextResponse.redirect(new URL(redirectUrl, request.url));
  }

  // VULNERABLE: No CSRF protection on server actions
  const response = NextResponse.next();
  response.headers.set('x-powered-by', 'Next.js'); // VULNERABLE: Information disclosure
  return response;
}

export const config = {
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
};

// File: app/api/users/route.ts
// Vulnerable API route: SQL injection, no auth, plain text password storage
import { NextRequest, NextResponse } from 'next/server';
import bcrypt from 'bcryptjs';
import jwt from 'jsonwebtoken';

// Mock user database (insecure, no parameterized queries)
const users: Array<{ id: string; email: string; password: string }> = [];

export async function POST(request: NextRequest) {
  try {
    const { email, password } = await request.json();

    // VULNERABLE: No input validation for email/password
    // VULNERABLE: SQL injection if using real DB (simulated here)
    const existingUser = users.find(u => u.email === email);
    if (existingUser) {
      return NextResponse.json({ error: 'User exists' }, { status: 400 });
    }

    // VULNERABLE: Weak password hashing (low rounds)
    const hashedPassword = await bcrypt.hash(password, 4); // Should be 12+ rounds

    // VULNERABLE: Hardcoded JWT secret
    const token = jwt.sign({ email }, 'hardcoded-secret-123', { expiresIn: '1h' });

    users.push({ id: crypto.randomUUID(), email, password: hashedPassword });
    return NextResponse.json({ token }, { status: 201 });
  } catch (error) {
    console.error('User creation failed:', error);
    return NextResponse.json({ error: 'Internal server error' }, { status: 500 });
  }
}

// File: lib/actions.ts
// Vulnerable server action: no auth, XSS, unvalidated input
'use server';

import { revalidatePath } from 'next/cache';

export async function submitComment(formData: FormData) {
  const comment = formData.get('comment') as string;
  // VULNERABLE: No input sanitization, XSS possible
  // VULNERABLE: No authentication check
  console.log(`New comment: ${comment}`); // Simulated storage
  revalidatePath('/comments');
  return { success: true, comment };
}

Implementation Details:

• Snyk Custom Rules (.snyk): Defines framework-specific patterns like middleware bypasses and hardcoded JWTs in app/api/**/*.ts. Snyk 1.130's remediation suggestions achieve 92% accuracy for Next.js 15 issues.
• CI/CD Gating: The GitHub Actions workflow runs snyk test on every PR, parses the JSON output, and fails the build if critical vulnerabilities are detected.
• DAST Runtime Scanning: ZAP 2.13 crawls the App Router, submits server action forms, and detects runtime vulnerabilities like reflected XSS (CWE-79), open redirects (CWE-601), and missing security headers (X-Content-Type-Options, X-Frame-Options).
• Reporting: The snyk-report.ts script aggregates severity levels and outputs a human-readable summary for engineering teams.

Pitfall Guide

1. Hardcoded Secrets in API Routes: Embedding JWT secrets or API keys directly in app/api/**/*.ts instead of using process.env or Next.js runtime environment variables.
2. Weak Cryptographic Parameters: Configuring bcrypt.hash() with 4 rounds instead of 12+, making password hashes trivially crackable via GPU clusters.
3. Unvalidated Server Action Inputs: Failing to sanitize or validate FormData in 'use server' functions, leading to reflected XSS or injection attacks in server-rendered responses.
4. Middleware Redirect Bypasses: Trusting query parameters for redirects without allowlist validation, enabling open redirect vulnerabilities (CWE-601) that bypass authentication flows.
5. Information Disclosure Headers: Leaving x-powered-by enabled in production middleware, revealing framework versions and aiding attacker reconnaissance (CWE-200).
6. Skipping DAST for Server-Side Rendering: Relying solely on SAST misses runtime vulnerabilities like reflected XSS in rendered HTML, missing CSRF tokens on server actions, or absent security headers (X-Frame-Options, X-Content-Type-Options).
7. Ignoring CI/CD Gating Thresholds: Allowing critical/high vulnerabilities to pass PR checks without automated fail-fast mechanisms, leading to drift and technical debt accumulation.

Deliverables

• 📘 Next.js 15 Security Blueprint: Architecture diagram detailing hybrid SAST/DAST pipeline, App Router attack surface mapping, and CI/CD gate placement.
• ✅ OWASP Top 10 2021 Checklist: Framework-specific verification matrix for Server Actions, Middleware, API Routes, and Edge Runtime configurations.
• ⚙️ Configuration Templates: Production-ready .snyk custom rules, GitHub Actions workflow (snyk-scan.yml), ZAP baseline scan configuration, and snyk-report.ts aggregation script.