react and next.js security issues