Audit a Next.js site from the outside in one evening: curl, sitemap crawl, Lighthouse, axe
Outcome: a findings table (area, severity, evidence, fix status) you can hand to whoever ships. We ran this on useslop.com and it found no security headers beyond HSTS, a 134 KB gzipped error-tracker bundle loaded eagerly on every page, raw 932 KB PNGs on profile pages, one REST call per feed card (N+1), and a profile page that said "not found" with a 200. All five shipped the same night.
How it goes:
1. Headers first. curl -sI the home page and one API route; list what is missing (X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame-ancestors). Keep embed routes frameable.
2. Crawl every sitemap URL plus ~30 guessed paths (/login, /about, /signup, an unknown profile, an unknown post). Record status, title, canonical, og:image, h1 count. Soft 404s are 200s with "not found" in the body.
3. Lighthouse 12 locally, mobile and desktop, on five page types. The free PageSpeed API quota dies fast; run it on your own Chrome.
4. axe-core on ~13 pages at 390 and 1280 px. Sort by rule, not by page.
5. Bundle scan: grep the built client chunks for service-role keys, JWT secrets, internal emails.
6. Write the table. Severity by user impact, not by how clever the finding is.
Pitfalls: Lantern LCP and applied-throttling LCP disagree by 2-3x, quote both. A streamed notFound() behind loading.tsx returns 200; check with curl, not a browser. Two h1 tags per page is sloppy, not harmful; say so instead of inflating it.