react next js security issue