🛡️ Secure Next.js Starter

A production-ready Next.js 15 boilerplate with 7 security headers, CI/CD vulnerability scanning, and hardened defaults — all pre-configured so you can ship secure apps from day one.

---

What's Included

🔒 Security Headers (via next.config.ts)

Header	Value	Protection
X-Content-Type-Options	nosniff	Prevents MIME-type sniffing
X-Frame-Options	DENY	Blocks clickjacking via iframes
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload	Enforces HTTPS for 2 years
Referrer-Policy	strict-origin-when-cross-origin	Controls referrer data leakage
Permissions-Policy	geolocation=(), microphone=(), camera=()	Restricts browser API access
X-XSS-Protection	1; mode=block	Enables browser XSS filtering
X-Permitted-Cross-Domain-Policies	none	Blocks Flash/PDF cross-domain access

Additionally, X-Powered-By is removed (poweredByHeader: false) to prevent server fingerprinting.

🔍 CI/CD Security Scanning

A GitHub Actions workflow (.github/workflows/security.yml) runs automatically on every pull request:

• Secret Detection — Catches API keys, tokens, and credentials before they're merged.
• PII Scanning — Detects personally identifiable information in your codebase.
• Dependency Auditing — Flags known vulnerabilities in your npm packages.

Powered by Precogs AI.

⚡ Modern Stack

• Next.js 15 with App Router
• TypeScript (strict mode)
• Tailwind CSS v4
• React Compiler enabled
• ESLint pre-configured

---

Quick Start

# Clone
npx create-next-app@latest -e https://github.com/PrecogsAI/secure-nextjs-starter my-app

# Or clone directly
git clone https://github.com/PrecogsAI/secure-nextjs-starter.git
cd secure-nextjs-starter
npm install
npm run dev

Open http://localhost:3000.

---

Verify Your Headers

After deploying, scan your site at securityheaders.com to confirm all headers are active.

---

Project Structure

├── .github/
│   └── workflows/
│       └── security.yml          # Precogs AI security scan on PRs
├── src/
│   └── app/
│       ├── layout.tsx            # Root layout with SEO metadata
│       ├── page.tsx              # Landing page
│       └── globals.css           # Global styles
├── next.config.ts                # Security headers configuration
├── package.json
└── tsconfig.json

---

Customization

Adding Content-Security-Policy

CSP is not included by default because it varies per project. To add it, extend the securityHeaders array in next.config.ts:

{
  key: "Content-Security-Policy",
  value: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;",
}

Upgrading the Security Scan

The included workflow uses the free tier. To enable deep code analysis, update .github/workflows/security.yml:

- uses: PrecogsAI/precogs-action@v1
  with:
    scan_type: pro
    api_key: ${{ secrets.PRECOGS_API_KEY }}

---

License

MIT — use this starter for anything.

---

Security powered by Precogs AI