Next.js adds failure modes React SPA reviews miss: Server Components vs client bundles, caching and revalidation mistakes, Server Actions auth gaps, and env leakage across edge and node runtimes. CodeCritic reviews the diff with that stack in mind.
Accidental "use client" uptrees, secrets imported into client modules, and data fetchers that should stay server-only.
Stale static shells, mis-set revalidate tags, and route segment configs that serve private data from a shared cache.
Server Actions without authz checks, CSRF assumptions, and form handlers that trust client-provided ids.
Ask CodeCritic - and humans - to dwell on these when the PR touches app/ or pages/.
Workflow
Paste or multi-file upload the route, action, and related client component together.
Keep shared auth utilities as Context only when they are unchanged but required for judgment.
Enable GitHub Action or webhooks so App Router changes get the same pass in CI.
Overview
The React guide focuses on hooks, effects, and client-state pitfalls common to SPAs. Next.js pages live or die on server/client boundaries, caching, and deployment runtime - different review questions even when JSX looks familiar.
Pair this page with TypeScript or JavaScript language hubs when you need language-level patterns; use this landing when the risk is framework routing and data lifetime.
Sample output
Mutation trusts the caller identity without verifying the session before updating a subscription. Call your auth helper before any write.
Before
export async function updatePlan(planId: string) {
await db.subscription.update({ planId });
}Suggested direction
export async function updatePlan(planId: string) {
const user = await requireUser();
await db.subscription.update({ userId: user.id, planId });
}Static or shared cache settings risk serving one user payload to another. Prefer dynamic rendering or user-scoped tags for private dashboards.
Before
export const revalidate = 3600;
export default async function Dashboard() {
return <PrivateStats />;
}Suggested direction
export const dynamic = 'force-dynamic';
export default async function Dashboard() {
return <PrivateStats />;
}Illustrative patterns from real review categories. Your output depends on diff size, language, and context.
FAQ
Start free, upload the route plus Server Action, and confirm Policy findings match your App Router standards.