Nuxt

Security scanning for Nuxt apps

Nuxt 3’s useRuntimeConfig pattern (with separate public and private keys) handles the env-leak problem well. Where Nuxt apps still slip: missing CSP/HSTS, /api/* CORS misconfig, and cookies set without proper flags.

Most common issues

  1. 01Missing CSP/HSTS on the deployed app (use nuxt-security or @nuxtjs/security module)
  2. 02/api/* server routes with wildcard CORS or no auth check
  3. 03Session cookies missing Secure/HttpOnly when set via setCookie

What SafeToShip checks for Nuxt

  • headers
  • js-secrets
  • cors
  • cookies
  • ssl
  • exposed-files

FAQ

Frequently asked questions

What is the easiest way to add CSP in Nuxt?
npm i nuxt-security — it ships secure defaults for CSP, HSTS, X-Content-Type-Options, and frame-ancestors. Override individual directives only as needed.
Are useRuntimeConfig public values safe to ship?
Yes — anything under runtimeConfig.public is shipped to the client by design. Use that namespace ONLY for non-secret values. Server secrets stay under the top-level runtimeConfig.

Fix guides

Common Nuxt fixes

Missing CSP header

A missing Content-Security-Policy header lets attackers inject scripts into your site. Here is what CSP does, why you need it, and how to add it in Next.js, Vercel, and Supabase apps.

Read more

Missing HSTS header

HSTS tells browsers to always use HTTPS for your site. Without it, users can be downgraded to HTTP and have sessions stolen. Here is how to add HSTS on Vercel, Next.js, and other hosts.

Read more

CORS allows all origins

An Access-Control-Allow-Origin: * policy lets any site call your API. Sometimes that is fine, often it is a mistake. Here is how to decide and fix it.

Read more

Cookie missing Secure flag

Cookies without the Secure flag can be sent over HTTP, leaking session tokens to anyone on the same network. Here is how to set it.

Read more

Hardcoded API key in JS

Any secret in your client bundle is public. Here is how to find them, rotate them, and move the calls server-side.

Read more

Run a Nuxt security scan

Free. 70+ checks. 60 seconds.