Static Site Generation is one of the best performance tools in modern web frameworks. It is also a data-exposure footgun if you pre-render pages that depend on private data.

How the leak happens

Next.js serves SSG data from predictable URLs under _next/data/<BUILD_ID>/.... If a per-user route (say, a referral page) is statically generated, its underlying JSON is publicly fetchable — no session required. On one fintech app we tested, that JSON exposed internal userId UUIDs and confirmed the existence of admin and support accounts by simply appending .json to a username. Full details: the Next.js PII-leak write-up.

Those leaked UUIDs are not harmless identifiers — they feed authenticated API calls elsewhere, opening the door to IDOR and session-targeting.

Guardrails

• Do not statically render pages whose content is user-specific and private.
• Validate the session in your data-fetching logic; render private data at request time, authenticated.
• Never serialize internal database UUIDs into client-visible JSON.
• Treat _next/data/ as an API surface and protect it accordingly.

Fast and public are not the same thing. Decide per-route which one you actually want.