SEAL OF SIGMUNDSECURITY DESK
Return home

CURRENT PRODUCT BOUNDARY

What the scanner can establish today.

This is generated from the versioned scanner and application-layout catalogs. It describes passive source evidence—not runtime exploitability, complete vulnerability coverage, or a guarantee that an application is secure.

SCANNER
0.22.0
CATALOG
seal-passive-web-recipe-catalog
UPDATED
2026-09-03
RECIPES
60

SUPPORTED INPUT

Versioned framework profiles and layouts

Certified framework boundaries

  • Next.js · 16.1.6 or 16.3.3 · React 19.2.0 · React DOM 19.2.0 / React 19.2.8 · React DOM 19.2.8
  • React · Stable React and React DOM 16–19 · Aligned major versions · browser-source raw-HTML contract
  • Vue · SFC 3.5.42 · 3.4.38 · 3.3.13 · Render/JSX contract >=3.0.0 <4.0.0
  • Angular · 22.1.4 · 21.2.0 · 20.3.0 · Component sanitizer-bypass and direct-DOM contracts

Application layouts

  • npm lockfile v3 with root or apps/packages workspaces · roots . or apps/web · npm package-lock.json v3

AVAILABLE

Available in the current scanner

60
configurationREPO-INVENTORY-001

Supported application and dependency inventory

Inventory the admitted application root, supported framework versions, manifests, source files, and direct dependencies.

Exact supported evidence boundary
  • npm lockfile v3
  • Certified Next.js 16.1.6 / React 19.2.0 profile
  • Certified Next.js 16.3.3 / React 19.2.8 profile
  • Aligned stable standalone React and React DOM >=16.0.0 <20.0.0 profile
configurationWEB-APP-INVENTORY-001

Passive web application surface inventory

Map bounded Next.js routes, server and client boundaries, known authentication and database integrations, environment-variable names, literal external origins, and security-relevant configuration without executing application code.

Exact supported evidence boundary
  • Certified Next.js 16.1.6 and 16.3.3 App Router static file conventions
  • Certified Next.js 16.1.6 and 16.3.3 Pages Router static file conventions
  • Aligned stable standalone React and React DOM >=16.0.0 <20.0.0 source surfaces
  • TypeScript syntax parser 5.9.3
dependenciesFRAMEWORK-MAINTENANCE-001

Framework and build-tool maintenance currency

Classify resolved Next.js, standalone React, Vue, Angular, and Vite versions against a dated upstream maintenance-policy snapshot without representing age alone as a known vulnerability.

Exact supported evidence boundary
  • Next.js Active and Maintenance LTS policy as of 2026-09-01
  • React current and archived major index as of 2026-09-01
  • Vue current documented major and Vue 2 end-of-life boundary as of 2026-09-01
  • Angular Active and LTS policy as of 2026-09-01
  • Vite supported-version policy as of 2026-09-01
  • npm lockfile v3 resolved versions
configurationNEXT-CONFIG-001

Statically recognizable Content Security Policy declaration

Observe whether the admitted Next.js configuration contains a statically recognizable Content-Security-Policy header declaration.

Exact supported evidence boundary
  • Certified Next.js 16.1.6 and 16.3.3 static configuration syntax
secretsVITE-PUBLIC-ENV-001

Sensitive-looking Vite public environment reference

Observe a sensitive-looking identifier referenced through the default Vite client-public import.meta.env namespace without reading or inferring its value.

Exact supported evidence boundary
  • Tested Vite range >=2.0.0 <9.0.0
  • Default VITE_ public environment prefix
  • Static src/ import.meta.env property access
  • TypeScript syntax parser 5.9.3
configurationVITE-BROWSER-SOURCEMAP-001

Vite production browser source-map generation

Observe whether exact static Vite configuration enables separate, inline, or hidden production browser source maps.

Exact supported evidence boundary
  • Tested Vite range >=2.0.0 <9.0.0
  • Exact named defineConfig import
  • Static default-exported configuration object
  • TypeScript syntax parser 5.9.3
configurationANGULAR-BROWSER-SOURCEMAP-001

Angular production browser source-map generation

Observe whether the exact selected Angular application build target enables browser script source maps in its named production configuration.

Exact supported evidence boundary
  • Angular 20.3.0, 21.2.0, and 22.1.4
  • Root angular.json workspace
  • One exact defaultProject or one supported application
  • Angular application, browser, and browser-esbuild builders
  • Boolean or documented boolean-object sourceMap form
sourceJS-ACTIVE-CONTENT-001

Active-content sink observation

Observe a bounded syntax catalog of JavaScript and React active-content sinks and limited same-node input signals.

Exact supported evidence boundary
  • TypeScript syntax parser 5.9.3
  • Bounded same-node source recognition
sourceREACT-UNTRUSTED-HTML-001

Next.js search parameter to React raw-HTML flow

Resolve a bounded immutable intraprocedural path from an App Router page searchParams prop to React dangerouslySetInnerHTML.__html.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Closed immutable intraprocedural flow adapter
sourceREACT-CLIENT-UNTRUSTED-HTML-001

Next.js Client Component search parameter to React raw-HTML flow

Resolve a bounded immutable intraprocedural path from exact next/navigation useSearchParams().get(static-key) to React dangerouslySetInnerHTML.__html.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Closed immutable intraprocedural flow adapter
sourceREACT-BROWSER-UNTRUSTED-HTML-001

Browser-controlled data to React raw-HTML flow

Resolve a bounded immutable intraprocedural path from exact versioned URL query, location hash, or browser-storage source adapters to React dangerouslySetInnerHTML.__html.

Exact supported evidence boundary
  • Tested aligned React and React DOM major range >=16.0.0 <20.0.0
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • TypeScript syntax parser 5.9.3
  • Directly default-exported browser component
  • Closed immutable intraprocedural flow adapter
sourceVUE-BROWSER-UNTRUSTED-HTML-001

Browser-controlled data to Vue v-html flow

Resolve a bounded immutable same-SFC path from exact browser or imported Vue Router sources to Vue v-html.

Exact supported evidence boundary
  • Vue 3.3.13, 3.4.38, and 3.5.42
  • Versioned vue-3.x-sfc-script-setup-v1 profiles
  • vue-sfc-parse-only@3.5.42 with frozen cross-version fixtures
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • vue-router-query@1
  • vue-router-params@1
  • vue-router-hash@1
  • JavaScript or TypeScript script setup
  • Closed immutable same-SFC flow adapter
sourceVUE-BROWSER-UNTRUSTED-URL-001

Browser-controlled data to native Vue href binding

Resolve a bounded immutable same-SFC path from exact browser or imported Vue Router sources to a dynamic href on a native HTML anchor.

Exact supported evidence boundary
  • Vue 3.3.13, 3.4.38, and 3.5.42
  • Versioned vue-3.x-sfc-script-setup-v1 profiles
  • vue-sfc-parse-only@3.5.42 with frozen cross-version fixtures
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • vue-router-query@1
  • vue-router-params@1
  • vue-router-hash@1
  • Native HTML a[href] and area[href] dynamic bindings
  • Closed immutable same-SFC flow adapter
sourceVUE-RENDER-INNER-HTML-001

Browser-controlled data to Vue render-function or JSX innerHTML

Resolve a bounded immutable same-file path from exact browser sources to exact Vue h() or JSX innerHTML authorities.

Exact supported evidence boundary
  • Stable Vue 3.x render-source contract
  • Frozen Vue 3.3.13, 3.4.38, and 3.5.42 fixtures
  • typescript-syntax@5.9.3
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • vue-h-inner-html@3-v1
  • vue-jsx-inner-html@3-v1
  • Closed immutable lexical-flow adapter
sourceVUE-RUNTIME-TEMPLATE-001

Browser-controlled data to Vue runtime template compilation

Resolve a bounded immutable same-file path from an exact browser source to a template option consumed by compiler-including Vue createApp authority.

Exact supported evidence boundary
  • Vue 3.3.13, 3.4.38, and 3.5.42 exact profiles
  • typescript-syntax@5.9.3
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • Exact createApp import from vue/dist/vue.esm-bundler.js
  • Static template option without a competing render option
  • Closed immutable same-file flow adapter
sourceANGULAR-BROWSER-SANITIZER-BYPASS-001

Browser-controlled data to Angular DomSanitizer trust bypass

Resolve a bounded immutable same-component path from exact browser or ActivatedRoute snapshot sources to an exact DomSanitizer bypassSecurityTrust authority.

Exact supported evidence boundary
  • Angular 20.3.0, 21.2.0, and 22.1.4
  • Versioned angular-20/21/22-component-template-v1 profiles
  • angular-component-template-parse-only@22.1.4 with frozen cross-version fixtures
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • ActivatedRoute snapshot adapters
  • angular-dom-sanitizer-bypass@1
  • Constructor parameter-property or inject() authority
  • Closed immutable same-method flow adapter
sourceANGULAR-DIRECT-DOM-HTML-001

Browser-controlled data to Angular direct DOM HTML assignment

Resolve a bounded immutable same-component path from exact browser or ActivatedRoute snapshot sources to innerHTML or outerHTML on an exact ElementRef or document lookup authority.

Exact supported evidence boundary
  • Angular 20.3.0, 21.2.0, and 22.1.4
  • Versioned angular-20/21/22-component-template-v1 profiles
  • angular-component-template-parse-only@22.1.4 with frozen cross-version fixtures
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • ActivatedRoute snapshot adapters
  • angular-element-ref-native-element-html-assignment@1
  • angular-document-static-lookup-html-assignment@1
  • Closed immutable same-method flow adapter
sourceANGULAR-RENDERER-HTML-001

Browser-controlled data to Angular Renderer2 HTML property write

Resolve a bounded immutable same-component path from exact browser or ActivatedRoute snapshot sources to an exact Renderer2.setProperty innerHTML or outerHTML write.

Exact supported evidence boundary
  • Angular 20.3.0, 21.2.0, and 22.1.4
  • Versioned angular-20/21/22-component-template-v1 profiles
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • ActivatedRoute snapshot adapters
  • angular-renderer2-set-property-html@1
  • Constructor parameter-property or inject() authority
  • Closed immutable same-method flow adapter
sourceANGULAR-RUNTIME-TEMPLATE-001

Browser-controlled data to Angular JIT runtime component template

Resolve a bounded immutable same-file path from an exact browser source to a runtime Component template consumed by exact Angular createComponent authority with matching compiler evidence.

Exact supported evidence boundary
  • Angular 20.3.0, 21.2.0, and 22.1.4 exact profiles
  • typescript-syntax@5.9.3
  • browser-url-query@1
  • browser-location-hash@1
  • browser-storage@1
  • Exact Component and createComponent imports from @angular/core
  • Exact matching resolved @angular/compiler dependency and import
  • Static runtime component binding consumed by createComponent
  • Closed immutable same-file flow adapter
sourceDOM-INNER-HTML-001

Next.js Client Component search parameter to DOM innerHTML flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to innerHTML on an exact document.getElementById(static-id) binding.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Exact document.getElementById binding
sourceDOM-OUTER-HTML-001

Next.js Client Component search parameter to DOM outerHTML flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to outerHTML on an exact document.getElementById(static-id) binding.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Exact document.getElementById binding
sourceDOM-INSERT-ADJACENT-HTML-001

Next.js Client Component search parameter to insertAdjacentHTML flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to insertAdjacentHTML on an exact document.getElementById(static-id) binding.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Exact document.getElementById binding and static insertion position
sourceDOM-DOCUMENT-WRITE-001

Next.js Client Component search parameter to document.write flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to the unshadowed browser document.write interpreter.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Unshadowed document.write with one argument
sourceJS-EVAL-001

Next.js Client Component search parameter to direct eval flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to unshadowed direct eval string interpretation.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Unshadowed direct eval with one string argument
sourceJS-FUNCTION-CONSTRUCTOR-001

Next.js Client Component search parameter to Function constructor flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to unshadowed Function call or construction source interpretation.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Unshadowed Function call or new construction
sourceJS-SET-TIMEOUT-STRING-001

Next.js Client Component search parameter to string setTimeout flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to an unshadowed setTimeout string handler.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Unshadowed setTimeout with an admitted string handler
sourceJS-SET-INTERVAL-STRING-001

Next.js Client Component search parameter to string setInterval flow

Resolve a bounded immutable path from exact next/navigation useSearchParams().get(static-key) to an unshadowed setInterval string handler.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Unshadowed setInterval with an admitted string handler
sourceNEXT-CLIENT-NAVIGATION-001

Next.js Client Component search parameter to navigation flow

Resolve a bounded path from exact next/navigation useSearchParams().get(static-key) to an exact useRouter().push or .replace navigation interpreter.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Directly default-exported Client Component
  • Direct source or one immutable destination binding
sourceNEXT-SERVER-REDIRECT-001

Next.js page search parameter to server redirect flow

Resolve a bounded path from an App Router page searchParams property to exact next/navigation redirect or permanentRedirect.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Default App Router page function
  • Direct source or one immutable destination binding
sourceNEXT-ROUTE-REDIRECT-001

Next.js Route Handler query parameter to redirect flow

Resolve a bounded path from exact NextRequest.nextUrl.searchParams.get(static-key) in a GET Route Handler to exact NextResponse.redirect.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Named GET App Router Route Handler
  • Direct source or one immutable destination binding
sourceNEXT-ROUTE-OUTBOUND-REQUEST-001

Next.js Route Handler query parameter to outbound request flow

Resolve a bounded path from exact NextRequest.nextUrl.searchParams.get(static-key) in a GET Route Handler to an unshadowed server fetch destination.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Named GET App Router Route Handler
  • Direct source or one immutable destination binding
  • Unshadowed global fetch
sourceNEXT-SERVER-ACTION-REDIRECT-001

Next.js Server Action parameter to redirect flow

Resolve a bounded path from a client-controlled parameter of an exact module-level or inline async Server Action to exact next/navigation redirect or permanentRedirect.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Module-level and function-level use server directives
  • Direct source or bounded immutable propagation
  • Exact non-aliased next/navigation redirect imports
sourceNEXT-SERVER-ACTION-OUTBOUND-REQUEST-001

Next.js Server Action parameter to outbound request flow

Resolve a bounded path from a client-controlled parameter of an exact module-level or inline async Server Action to an unshadowed server fetch destination.

Exact supported evidence boundary
  • Next.js 16.1.6 with React and React DOM 19.2.0
  • Next.js 16.3.3 with React and React DOM 19.2.8
  • TypeScript syntax parser 5.9.3
  • Module-level and function-level use server directives
  • Direct source or bounded immutable propagation
  • Unshadowed global fetch
configurationNEXT-IMAGE-LOCAL-IP-001

Next.js image optimizer local-IP allowance

Observe whether the built-in Next.js image optimizer is statically configured to allow local-network IP destinations.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3
  • Static Next.js configuration syntax
configurationNEXT-IMAGE-SVG-001

Next.js optimized SVG safety controls

When optimized SVG serving is enabled, observe whether attachment disposition and a restrictive script and sandbox policy are statically declared.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3
  • Static literal image configuration
configurationNEXT-BROWSER-SOURCEMAP-001

Production browser source-map publication

Observe whether Next.js is statically configured to emit and serve browser source maps in production.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3
  • Static Next.js configuration syntax
configurationNEXT-RESPONSE-HEADERS-001

Static global browser-security response-header baseline

Observe whether a supported Next.js configuration statically declares a global CSP, framing control, MIME-sniffing control, bounded referrer policy, and one-year HSTS baseline.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3
  • Static literal next.config headers() return arrays
  • Global /:path* and /(.*) source patterns
secretsSOURCE-CREDENTIAL-LITERAL-001

Secret-safe credential literal observation

Observe a bounded high-confidence catalog of provider-prefixed credential literals and private-key headers without retaining matched values.

Exact supported evidence boundary
  • GitHub documented token prefixes
  • Generic private-key headers
  • Bounded UTF-8 source and configuration files
secretsSOURCE-PROVIDER-CREDENTIAL-001

Secret-safe provider credential literal observation

Observe a bounded high-confidence catalog of AWS access-key identifiers and Stripe, Slack, npm, and Google credential-shaped literals without retaining matched values.

Exact supported evidence boundary
  • AWS access-key identifier prefixes
  • Stripe secret-key prefixes
  • Slack token prefixes
  • npm access-token prefixes
  • Google API-key prefixes
  • Bounded UTF-8 source and configuration files
authenticationAUTH-SESSION-COOKIE-001

Static authentication and session cookie controls

Observe statically named authentication/session cookie issuance and require HttpOnly, Secure, and a bounded SameSite declaration without retaining cookie values.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3
  • React 19.2.0 and 19.2.8
  • TypeScript 5.9.3 syntax
  • Statically named cookies().set and response.cookies.set declarations
authorizationAUTHZ-ENTRYPOINT-ENFORCEMENT-001

Server entrypoint authorization evidence inventory

Inventory supported Route Handler, module-level Server Action, and inline Server Action entrypoints and classify locally recognizable guard-call evidence without treating absence or naming as proof.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3 Route Handlers
  • React 19.2.0 and 19.2.8 module-level Server Actions
  • Next.js function-level async Server Actions in non-client modules
  • Pinned local guard-call catalog
authorizationAUTHZ-TENANT-OPERATION-001

Bounded tenant-operation authorization controls

Resolve exact Next.js and React mutation entrypoints through local calls to tenant-scoped PostgreSQL operations and emit only when principal, tenant, resource, and action controls are absent from a completely resolved supported path.

Exact supported evidence boundary
  • Next.js 16.1.6 and 16.3.3 Route Handlers
  • React 19.2.0 and 19.2.8 module-level Server Actions
  • Clerk Next.js 7.8.1 auth and permission adapters
  • postgres 3.4.9 tagged templates
  • Pinned PostgreSQL tenant schema and forced-RLS policy forms
  • TypeScript syntax parser 5.9.3
infrastructureINFRA-DEPLOYMENT-HARDENING-001

Static container and GitHub Actions hardening declarations

Observe bounded Docker final-stage user declarations plus GitHub Actions write-all permissions and mutable action references without claiming effective deployed policy.

Exact supported evidence boundary
  • Line-oriented Dockerfile final stages
  • GitHub Actions YAML uses declarations
  • GitHub Actions top-level write-all permissions
sourceNEXT-CLIENT-ROUTE-PARAM-NAVIGATION-001

Next.js client route parameter to navigation flow

Resolve an exact useParams route property to useRouter push or replace in one Client Component.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Directly default-exported Client Component
  • Exact non-aliased next/navigation hooks
sourceNEXT-SERVER-ROUTE-PARAM-REDIRECT-001

Next.js page route parameter to server redirect flow

Resolve an App Router page params property to exact redirect or permanentRedirect.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Default App Router page function
  • Exact non-aliased next/navigation redirect
sourceNEXT-ROUTE-JSON-BODY-OUTBOUND-REQUEST-001

Next.js JSON request body to outbound request flow

Resolve a static property of an exact Route Handler request.json result to global fetch.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named POST, PUT, PATCH, or DELETE Route Handler
  • Exact Request or NextRequest parameter
  • Unshadowed global fetch
sourceNEXT-ROUTE-FORM-DATA-OUTBOUND-REQUEST-001

Next.js form data to outbound request flow

Resolve an exact Route Handler request.formData static field to global fetch.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named POST, PUT, PATCH, or DELETE Route Handler
  • Exact Request or NextRequest parameter
  • Unshadowed global fetch
sourceNEXT-ROUTE-HEADER-OUTBOUND-REQUEST-001

Next.js request header to outbound request flow

Resolve an exact static request header to global fetch in a Route Handler.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named Route Handler
  • Request headers or exact next/headers authority
  • Unshadowed global fetch
sourceNEXT-ROUTE-COOKIE-OUTBOUND-REQUEST-001

Next.js request cookie to outbound request flow

Resolve an exact static request cookie value to global fetch in a Route Handler.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named Route Handler
  • NextRequest cookies or exact next/headers authority
  • Unshadowed global fetch
sourceDOM-LOCATION-HASH-INNER-HTML-001

Browser location hash to DOM innerHTML flow

Resolve exact location.hash to innerHTML on an exact document.getElementById binding in one Client Component.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Directly default-exported Client Component
  • Exact browser and DOM authorities
sourceNODE-ROUTE-SHELL-COMMAND-001

Next.js request input to child-process shell command

Resolve supported Route Handler request input to the command string of exact Node.js exec or execSync authority.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named App Router Route Handler
  • Exact child_process exec or execSync import
  • Closed immutable intraprocedural flow adapter
sourceNODE-ROUTE-SHELL-SPAWN-001

Next.js request input to shell-enabled process spawn

Resolve supported Route Handler request input to the executable or arguments of exact spawn or spawnSync with an exact inline shell:true option.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named App Router Route Handler
  • Exact child_process spawn or spawnSync import
  • Exact inline shell:true options
  • Closed immutable intraprocedural flow adapter
sourceNODE-ROUTE-DYNAMIC-EXECUTABLE-001

Next.js request input controls child-process executable selection

Resolve supported Route Handler request input to the executable selected by exact execFile, execFileSync, or shell-disabled spawn authority.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named App Router Route Handler
  • Exact child_process execFile, execFileSync, spawn, or spawnSync import
  • Closed immutable intraprocedural flow adapter
sourceNODE-ROUTE-FILE-READ-PATH-001

Next.js request input reaches a filesystem read path

Resolve supported Route Handler request input to the path argument of exact Node.js file-read authority.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named App Router Route Handler
  • Exact named Node.js fs read import
  • Closed immutable intraprocedural flow adapter
sourceNODE-ROUTE-FILE-WRITE-PATH-001

Next.js request input reaches a filesystem write path

Resolve supported Route Handler request input to the path argument of exact Node.js file-write authority.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named App Router Route Handler
  • Exact named Node.js fs write import
  • Closed immutable intraprocedural flow adapter
sourceNODE-ROUTE-FILE-DELETE-PATH-001

Next.js request input reaches a filesystem deletion path

Resolve supported Route Handler request input to the path argument of exact Node.js file-deletion authority.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • Named App Router Route Handler
  • Exact named Node.js fs deletion import
  • Closed immutable intraprocedural flow adapter
sourcePOSTGRESJS-ROUTE-UNSAFE-QUERY-TEXT-001

Next.js request input reaches Postgres.js unsafe query text

Resolve supported Route Handler request input to the SQL-text argument of an exact Postgres.js sql.unsafe call.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • postgres 3.4.9
  • Named App Router Route Handler
  • Exact default postgres import and direct immutable client binding
  • Closed immutable intraprocedural flow adapter
sourceNODE-POSTGRES-ROUTE-DYNAMIC-QUERY-TEXT-001

Next.js request input reaches node-postgres query text

Resolve supported Route Handler request input to the query-text argument of an exact node-postgres Pool or Client query call.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • pg 8.23.0
  • Named App Router Route Handler
  • Exact named Pool or Client import and direct immutable construction
  • Closed immutable intraprocedural flow adapter
sourcePRISMA-ROUTE-UNSAFE-RAW-QUERY-TEXT-001

Next.js request input reaches Prisma unsafe raw query text

Resolve supported Route Handler request input to the SQL-text argument of an exact Prisma unsafe raw-query call.

Exact supported evidence boundary
  • Certified Next.js 16 profiles
  • @prisma/client 6.19.0
  • Named App Router Route Handler
  • Exact named PrismaClient import and direct immutable construction
  • Closed immutable intraprocedural flow adapter
dependenciesNPM-OSV-001

Interval-bound offline npm advisory matching

Match the independently reproduced npm dependency closure against the pinned offline OSV database and bind each installed version to its exact supported OSV SemVer interval.

Exact supported evidence boundary
  • npm lockfile v3
  • Configured application workspace closure
  • OSV-Scanner 2.5.1 offline npm database
  • Strict OSV SEMVER introduced, fixed, last_affected, and open intervals

LIMITED

Limited capabilities

0

No catalog entries currently carry this status. The category remains visible so an empty state is not mistaken for omitted disclosure.

PLANNED

Planned capabilities

0

No catalog entries currently carry this status. The category remains visible so an empty state is not mistaken for omitted disclosure.

UNSUPPORTED

Unsupported capabilities

0

No catalog entries currently carry this status. The category remains visible so an empty state is not mistaken for omitted disclosure.