{
  "next": "16.4.3",
  "scope": "Actual Next.js build and Route Handler invoking a Server Action, synthetic local identity; not production auth",
  "rows": [
    {
      "variant": "vulnerable",
      "user": "a",
      "id": "doc-b",
      "expected": 200,
      "actual": 200,
      "response": {
        "id": "doc-b",
        "displayName": "Synthetic document"
      }
    },
    {
      "variant": "fixed",
      "user": "a",
      "id": "doc-b",
      "expected": 403,
      "actual": 403,
      "response": {
        "error": "denied"
      }
    },
    {
      "variant": "fixed",
      "user": "a",
      "id": "doc-a",
      "expected": 200,
      "actual": 200,
      "response": {
        "id": "doc-a",
        "displayName": "Synthetic document"
      }
    },
    {
      "variant": "fixed",
      "user": "b",
      "id": "doc-b",
      "expected": 200,
      "actual": 200,
      "response": {
        "id": "doc-b",
        "displayName": "Synthetic document"
      }
    },
    {
      "variant": "fixed",
      "user": "anonymous",
      "id": "doc-a",
      "expected": 401,
      "actual": 401,
      "response": {
        "error": "denied"
      }
    }
  ],
  "passed": true,
  "guide": "nextjs-security",
  "reviewedAt": "2026-11-02",
  "reviewType": "implementation verification; not independent expert certification",
  "reproduction": "See repository tests/seo and docs/seo/README.md",
  "limits": "Local controlled fixture; not a production penetration test. All accounts and revisions are synthetic.",
  "sourceHashes": {
    "tests/seo/ci-contract.mjs": "b3f77fd31359e4c456ee23233f9c28d269306234c7a1b91227a919962f0695db",
    "tests/seo/next-example.mjs": "dafc096c09eafe42e418f7fa0d2379592cdc1e9a42c805ecf11d77f48b58de9b",
    "tests/seo/dependencies.mjs": "323950ef5fdd4d4fcfd539fabe46a050944ff60c6bbae5ceb34776413b01a2bd",
    "tests/seo/performance.mjs": "9801f7dc74f96fe200e744d4df85924437e4b18c8440e37a329aa5131381c220",
    "tests/seo/site.mjs": "6c219518b3277805f2a2a5edd79f5804bda1456a5b8f9adfef8533517ced2704",
    "tests/seo/access-fixture.py": "09b87f76fc534b18d5715067a7ce7519e04e3346c5e8686033fdab7bc755b64a",
    "tests/seo/capture-product.mjs": "2e9344dfe8fddecb761932f9063b92f870b331f967b50d4a484be6f3efb6d168",
    "tests/seo/examples.py": "54b0610b7ffe734198bbb720ce540e13d5736064275e0510c1b2b056aa02b1c5"
  }
}