You shipped your healthcare app. It works. Patients love it. Your security review is next week.

Here are five violations I see in almost every Next.js healthcare codebase I review -- and what to do about each one.

1. Your API Routes Have No Authentication Middleware

This is the most common violation I find. Next.js makes it easy to create API routes, and that ease creates a trap: nothing forces you to add authentication.

The problem: