Anas Sheikh

You add a small search box to your navbar. It reads the query string, so you reach for useSearchParams(). Everything works in next dev. You push, the deploy fails, and the build log says: useSearchParams() should be wrapped in a suspense boundary at page "/about". Read more: https://nextjs.org/docs/messages/missing-suspense-with-csr-bailout Notice the page name. You did not touch /about. That detail is the whole story.

Here is a bug report you will eventually get: "The signup form told me what was wrong on your machine, but on the live site it just says something went wrong." Nothing is broken. Next.js is doing this on purpose. But the code that triggers it looks completely normal, and it is in a lot of Server Actions tutorials, including a version in my own earlier post on replacing API routes.

There is a belief that quietly causes real vulnerabilities in Next.js apps: "Server Actions are internal, so the ID I pass into them is safe." It is not. A Server Action is an HTTP endpoint with a generated URL, and anyone with a browser's network tab can call it with whatever arguments they want.