Deploy

Don't leave debug, admin or test routes public

Find and protect leftover /admin, /api/debug and test routes, and make sure .env, .git and production source maps aren't publicly reachable.

Why it matters

Debug endpoints, admin pages and test routes generated during development often skip auth. Public source maps give anyone your original source code, including comments.

How to fix it

1. Search the code for routes named debug, test, seed, admin or internal, and remove them or protect them with server-side auth.
2. Request these paths on your live domain; each should return 404 or a login page.
3. Keep production browser source maps off (the Next.js default) or upload them privately to your error tracker.

for p in /admin /api/debug /api/test /.env /.git/config; do
  echo "$p $(curl -s -o /dev/null -w '%{http_code}' https://yourapp.com$p)"
done

How to verify

• All paths above return 404, 401, 403 or a login redirect.
• No .map files are served for your production JavaScript.

Related checks

• Check permissions on the server
• Log errors without logging secrets
• No secret keys in the browser bundle

Tick it off in the full checklist