Research

Things we measured, rather than assumed.

Every piece here is a measurement we ran ourselves, published with its method, its sample and its code, so you can re-run it and tell us we are wrong. Where we found our own tools at fault, that is in the write-up too — a study that only reports what flatters us is an advertisement.

11 August 2026 · 6 min We scanned 292 Next.js apps. One in five can delete your data without asking who you are. Forty per cent of what we found was not in an API route. It was in files whose names promise a library and deliver an endpoint. Read it →