Nowadays, a 'use server' directive is one of the most dangerous lines in a Next.js app you could possibly write.
The frontend dev who wrote it didn't realize they'd just published a public API endpoint, one that skips every check the rest of the app relies on. But no worries, that kind of miscommunication happens all the time in software development!
The line we all quietly stopped drawing
A wall stood in the past separating Frontend from Backend, with all the scary security work done on the Backend side.
Authentication checks, input validation, rate limiting - while the wall may have been unsightly, it made it clear where the threat model lived.
