Astro security checklist

Astro is a content-first web framework built around islands architecture: pages are mostly static HTML with small interactive components, and you opt into on-demand (SSR) rendering per route via an adapter. Astro 5 added server islands (server:defer) and a typed astro:env for splitting public vs secret variables. It’s a favorite for AI-built marketing sites, blogs, and docs that quietly grow an API.

Why Astro apps get shipped insecure

Astro feels ‘just static’, so it’s easy to forget that the moment you add an adapter and output: 'server' (or export const prerender = false), you’re running real server code with a real attack surface. AI tools scaffold src/pages/api endpoints and enable SSR without adding auth, and they reach for the PUBLIC_ prefix (or import.meta.env in a client script) to silence an undefined value — shipping the secret to the browser. The static-vs-on-demand split is subtle enough that even the docs have had build-time validation bugs.

The Astro-specific footguns

• Secrets exposed via the PUBLIC_ prefix: any PUBLIC_ var (or a secret referenced with import.meta.env inside a client-side <script>) is inlined into the built client bundle and readable by anyone.
• Unauthenticated API endpoints: files in src/pages/api/* export GET/POST handlers that hit your DB or third-party APIs with no check on APIContext cookies/locals, so they’re open to the internet.
• Accidentally shipping server code: flipping output: 'server' or setting prerender = false on a route turns build-time frontmatter into per-request server code — any secret used there now runs live and can leak through errors or SSRF.
• SSR host-header SSRF (CVE-2026-25545): Astro’s on-demand error pages trusted the incoming Host header, enabling a full-read SSRF via host-header injection — a pure on-demand-rendering footgun.
• Server-island key & replay gotchas: server islands encrypt props with a per-build key, so rolling deploys / CDN caching break decryption, and pre-6.1.10 encrypted props weren’t bound to their component (CVE-2026-45028, cross-component replay).

Astro security checklist

1. Audit every PUBLIC_ var and every import.meta.env used in a client <script> — move anything secret to a non-public var accessed only in server frontmatter or endpoints, and rotate exposed keys.
2. Add explicit auth to each src/pages/api endpoint (check APIContext cookies/locals), and confirm which routes are actually on-demand (prerender = false) so you know what’s reachable live.
3. Prefer astro:env with a typed schema splitting client/public from server/secret, so a secret used in the wrong context fails loudly instead of shipping.
4. Upgrade Astro past the SSRF and server-island fixes (host-header SSRF CVE-2026-25545; server-island replay fixed in 6.1.10) and set a stable ASTRO_KEY for rolling deploys.
5. In hybrid setups, verify no secret is read in a prerendered/static route where it’d be baked into output — keep secrets in on-demand handlers only.
6. Run a free Trust scan — its Astro route-extractor reaches your real src/pages/api endpoints and on-demand routes (not just the static HTML a blind crawler sees), plus a repo scan for PUBLIC_ leaks and vulnerable deps.

Bottom line

Astro looks static, but the moment you add an adapter you’ve got live server code — and that’s where AI tools skip the auth checks and leak secrets through PUBLIC_ or SSR endpoints. Lock down src/pages/api, keep secrets off the PUBLIC_ prefix, and stay patched past the SSRF and server-island CVEs. Trust actually reaches your on-demand routes and catches the leaks a blind crawler misses — free, no signup for the URL scan.