Next.js security review cost: $2,400 once, one app
Next.js security review cost is $2,400 once for one app, $1,200 to start. You own the report. No subscription. Frontend, auth, and the routes the UI calls.
In this article· 6 sections
A Next.js security review cost is $2,400 once for one application. $1,200 starts the work. The other $1,200 is due when the report is delivered, 48 hours after I can sign in. You own the PDF. There is no subscription.
That price is for a founder or an engineering lead with one Next.js app in production or on staging. I cover the frontend, login, and the route handlers and server actions those pages already call. Not a compliance letter. Not a second product on another host.
Short answer: The Next.js security review cost is $2,400 once, with $1,200 to start, for one app. I review the live UI, auth, and the calls that UI already makes, and I write the report 48 hours after access works. You own it. A scanner PDF and a $15,000 letterhead engagement are different products. The offer lives on the web application security review page.
What does a Next.js security review cost?
$2,400 once for one Next.js app, $1,200 to start, the rest on delivery. You are not buying a monthly scan, a source-code audit, or a stamp I do not hold.
WardenBit’s 2026 small-business guide puts most web app projects between $2,500 and $15,000, and the $100–$3,000 band as mostly automated scanning. Their own single-target plan is $2,500 per engagement, with one retest and a two-business-day turnaround once access is ready. SecureLeap’s startup table lists a small SaaS web app at $4,000–$12,000.
| What you are buying | 2026 price | What you actually get |
|---|---|---|
| Mostly automated scan | $100–$3,000 | Tool output, thin human judgment |
| This Next.js review | $2,400 once, $1,200 to start | One app, live UI, auth, the calls the UI already makes, report in 48 hours, one retest |
| WardenBit, one target | $2,500 per engagement | Their published one-target plan and one retest |
| Small SaaS web app, boutique | $4,000–$12,000 | Longer calendar, often packaged for a compliance conversation |
If you bought a $5,000 engagement once a year, two years is $10,000 and three years is $15,000. This review is $2,400 once. A second app, or a feature set that ships after the retest window, is a new quote. I am not renting you a seat.
The wider market, not only Next.js, is in web app security review cost. The same $2,400 figure is on pricing.
What does that $2,400 actually open?
I sign in as the role you grant and walk one live Next.js app: the pages, forms, uploads, downloads, and the server actions and route handlers those screens already call.
Next.js hides a real API behind a button. A server action and a route handler are still endpoints. The Next.js authentication guide says to treat both like public API endpoints, and to check that the user is allowed to perform the mutation or the read.
Checklist I run on one URL:
- A page that still renders for the wrong role, or for nobody signed in
- A server action the button already calls, checked again inside the action
- A route handler the page already fetches, with the same question
- A value built for the browser that is actually a secret
- A second role, if you grant one, and whether the first role’s records still open
- The Next.js version against the patched releases below, read from the app you named
I do not paste a recipe into the PDF. Path, role, severity, fix. The shape of that document is the sample pentest report.
Where should the Next.js auth check live?
The check belongs next to the data, not only in a redirect. Middleware, or the proxy check in the current Next.js docs, is an optimistic gate. It is not authorization for the action.
The same guide says that check should not be your only line of defense, and that most checks belong as close as possible to the data. A layout that returns nothing for a logged-out user does not cover every entry point. Nested routes and server actions still need their own check.
On March 21, 2025, the maintainers published GHSA-f82v-jwr5-mffw, CVE-2025-29927. If the only authorization check lived in middleware, it could be bypassed. Fixes shipped in 15.2.3, 14.2.25, 13.5.9, and 12.3.5. Next.js deployments hosted on Vercel were protected automatically. I still do not grade a redirect as the control. I grade whether the action and the handler refuse the wrong user.
I will not write the bypass into the report. If you are unpatched and self-hosted, the finding is the upgrade, plus whatever the live roles can still do on the URL you authorized.
What is left out of the price?
A source audit, mobile binaries, a cloud account review, phishing, a second hostname, and any procurement letter are left out. You are buying one URL, once, with no monthly fee.
Not included:
- Reading the repository or a monorepo as the product
- Admin rights inside your identity provider
- Infrastructure, containers, or a firewall review
- A CREST, PCI, or SOC report I am not certified to sign
- Exploit steps someone else could copy
- Features you ship after the free retest
Same invoice when the API is the one the Next.js UI already calls. A separate API-only program with no UI is a different quote.
This is not Workflow Automation and it is not AI Front Door. I am not chasing invoices in QuickBooks, and I am not letting a customer book from Claude or ChatGPT. Those are other offers.
How does the pass run?
Written permission plus a login that works is the trigger. The action is the walk of that one app. The PDF is the system of record. You fix, then I retest the same URL once.
- You name one production or staging URL, say what is out of scope, and authorize it in writing.
- You send a user who can sign in. A second role makes the checks sharper. I can still run one role and write that limit down.
- I exercise the pages and the calls they already make, then put test state back.
- You get severity, path, role, and a remediation an engineer can ticket. The clock for that PDF is the 48 hour security review: it starts when login works.
- You fix. I retest that same URL once, free, within 14 days.
If you want the document before credentials, ask for the sample from the contact form.
When this isn’t the right move yet
Wait if there is no login, you cannot authorize the URL, or you need a stamp instead of a ticket list. A marketing site is too early. So is buying this when the leak is a weekly ops job or a chat booking.
Wait if any of these are true.
- The site has no accounts. A brochure does not need this pass.
- Login is still a mock.
- You cannot name a person who owns the URL.
- A customer contract requires a certification I do not hold.
- You wanted the invoice chase, or a booking path inside an AI app. Different page, different price.
- You have four products and you want one number to cover all of them.
Buy it when one Next.js app has real users, you can grant a test account, and someone on the team will read a ranked list this week.
$1,200 reserves the work on the review page. I confirm scope in writing before I start. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.
FAQ
How much does a Next.js security review cost? +
One Next.js application is $2,400 once. $1,200 starts the work and $1,200 is due when the report is delivered. You own the PDF. There is no monthly fee. A second app, a mobile client, or a source-code audit is a separate quote. Public small-app quotes still cluster from about $2,500 to $15,000.
Is middleware enough to protect a Next.js app? +
No. Next.js treats middleware, or the newer proxy check, as optimistic. Authorize again next to the data. Server Actions and Route Handlers are public endpoints. A March 2025 advisory, CVE-2025-29927, covered apps that kept the only check in middleware. Patched releases exist. I still test the action, not the redirect.
How fast is the written report? +
The report is due 48 hours after access works. The clock starts when I can sign in on the URL you named, not when the invoice goes out. One free retest of that same URL is included within 14 days. The PDF has severity, path, role, and a fix. It does not include exploit steps or your credentials.
Do I need to send the GitHub repo? +
No. I review the running app: pages, auth, and the calls the UI already makes. Reading the repository is a different job and a different price. Tell me the Next.js major version and whether you host on Vercel or your own server. A working test user is the access I actually need.
