If you import a 'use server' function into a protected React component and pass it a typed TypeScript object, it looks and feels like a private, internal function call.

It isn't. Every exported 'use server' function in your codebase is compiled into a publicly reachable HTTP POST endpoint . Anyone with your action's identifier can invoke it directly from curl , Postman, or an automated script—with any JSON payload they want, completely bypassing your UI and often bypassing the authentication checks you thought were protecting it.

If your team treats Server Actions like regular TypeScript functions instead of public REST endpoints, your production app likely has an unauthenticated mutation or an authorization bug waiting to be discovered.

The Illusion: Why Developers Write Vulnerable Actions

Look at this common pattern in a modern Next.js App Router codebase:

// app/dashboard/billing/page.tsx (Protected by Layout) import { requireAdminSession } from ' @/lib/auth ' ; import { issueRefund } from '…