All teardowns
vercel logo

Free Verify scan · vercel/next.js

next.js scores 71/100

The React framework for the web.

Commit a5fe506 · 132 controls · Oct 15, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score71
next.js
42median 6886

Out of 100. Stronger than 63% of the 68 other assessed repositories.

Score

71/100

Rank 24 of 69 · median 68

Gaps

31

2 fewer than the median of 33

Critical

0 controls

0 root causes

Not visible

15

Needs admin access

What next.js does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch
Gaps31
next.js
15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 56% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in next.js's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

01

Governance leads the assessment.

10 of 10 visible controls pass in governance.

02

Security has the most room to improve.

8 visible controls remain open in security.

Priority

Fix these first

high

CODEOWNERS or review assignment

Covers 4 controls
  • CODEOWNERS or review assignment
  • CODEOWNERS or OWNERS file
  • Maintainer roster
  • Review of high-risk dependency changes

What Verify read

No tree evidence for owners.

Risk: With no ownership file, review lands on whoever is available rather than whoever understands the code.

text
Add CODEOWNERS.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design
high

Stale reviews dismissed

Covers 1 control
  • Stale reviews dismissed

What Verify read

Dismiss stale: false

Risk: Approvals that survive a new push mean the merged code is not the code anyone approved.

text
Dismiss stale reviews.
high

Last-push approval required

Covers 1 control
  • Last-push approval required

What Verify read

Last-push approval: false

Risk: A final push after approval can introduce anything, and the merge still shows a green review.

text
Require last-push approval.

Overview

Control map

Public-access limit

15 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

  • Administrator bypass restrictedhigh
  • Tag protectionhigh
  • Self-merge restrictedhigh
  • Bypass actors justifiedhigh
  • Push protection enabledhigh
  • Dependabot alertshigh
  • Secret scanning alertshigh
  • SAST required on default branchhigh
  • Environment secrets scopedhigh
  • Secret custodiansmedium
  • Agent identity in commitsmedium
  • Audit of agent actionsmedium
  • Audit of privileged actionsmedium
  • Private vulnerability reportinglow
  • Wait timer or freeze windowlow
Get Verify

Method

How Verify works

01

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

02

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

03

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

This free scanVerify on your repository
AccessPublicGitHub App you install
Controls read107 of 107All 107
Private repositoriesNoYes
ResultsPublished herePrivate to your organization

Evidence locker

Every control Verify checked

Review

11 of 26 pass

CI & tests

23 of 30 pass

Code quality

5 of 8 pass

Security

6 of 20 pass

Agents & AI

5 of 8 pass

Release & ops

11 of 22 pass

Docs

5 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 70Oct 15 · 71
  • Oct 10, 2026Delivery controls score 70 → 71d8bfc3c
  • Oct 10, 2026Agent workflow permissions · Agents & AI — gap → confirmedd8bfc3c

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Read-only access. No code stored. How Canon handles your data →

View vercel/next.js on GitHub

Maintain next.js? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.