Security · Next.js (App Router)
What is security.txt and should I have one in Next.js (App Router)
It is a two-line file naming where to send a security report. Without it, someone who finds a problem in your product has to guess — and the usual outcome is that they post it publicly instead of telling you.
The fix for Next.js (App Router)
13x detects your framework from the response and hands you this version rather than the generic one — below 50% confidence it hedges and gives you the generic one instead.
Put the file at public/.well-known/security.txt. Files in public/ are served from the root, so it resolves at the required path — no route handler needed.
On a different stack? The general version of this fix explains what 13x checks and why it matters, without assuming a framework.
Check your Next.js (App Router) site
113 deterministic checks against your live URL, in about 30 seconds. Framework detected from the response, so every fix comes back in the form your stack actually uses.
No signup. Results in 30 seconds.