Remix security checklist

Remix (now merged into React Router 7) is a full-stack React framework built around route modules: each route exports a loader (server GET) and an action (server mutation) that the browser calls over the network. The mental model that trips people up is that these are not private helpers — every loader and action is a real, directly callable API endpoint.

Why Remix apps get shipped insecure

Ship-fast AI tools treat loaders and actions as if they were internal functions and forget that the client fetches them by URL. You can’t trust one route to protect another — parent route auth does not automatically cover a child route’s loader — so any loader or action without its own check becomes an open endpoint, and anything a loader returns is serialized into the page for anyone to read.

The Remix-specific footguns

• Loaders and actions with no auth = open endpoints and IDOR: every route’s loader (GET) and action (POST/PUT/DELETE) is directly callable by URL. AI-generated routes commonly read an id from params/formData and query it with no session or ownership check, so changing the id in the URL returns or edits someone else’s data.
• Assuming parent auth protects children: a common pattern is to gate a layout route and assume nested routes inherit it. Remix fetches child loaders independently, so if a child route’s loader lacks its own check it runs unprotected — you can’t trust an endpoint to protect another endpoint.
• Server secrets leaking into the client bundle: importing a module that touches an API key or DB client from client-reachable code can pull it into the browser bundle. Secrets belong in .server.ts / .server directories (or only inside loader/action bodies) so the compiler keeps them off the client.
• Over-fetching loaders that serialize sensitive fields: a loader that returns a whole user or record sends every field to the browser via JSON — passwordHash, email, internal flags, tokens — even if the UI only shows a name. This is exactly how CVE-2025-55009 (AuthKit Remix) exposed sealed sessions and access tokens: they were returned from a loader and embedded in the page.
• CVE-2025-31137 (Host / X-Forwarded-Host URL manipulation): on Remix 2 / React Router 7 with the Express adapter, a crafted Host or X-Forwarded-Host header can inject a path into the parsed URL, enabling cache poisoning (CPDoS), WAF bypass, and XSS escalation. Fixed in Remix 2.16.3 / React Router 7.4.1.

Remix security checklist

1. Treat every loader and every action as a public API endpoint: add an explicit authentication and authorization check at the top of each one — verify the session AND that the current user owns the record it touches. Never rely on a parent route to guard a child.
2. Return only the fields the UI needs from loaders. Shape the response (pick id/name/etc.) instead of returning raw DB rows, and never return tokens, session artifacts, or password fields — remember loader output is serialized to the client.
3. Keep secrets in .server.ts files or .server directories (or strictly inside loader/action bodies) and let the build fail if server-only code reaches the client graph — don’t import DB clients or key-bearing modules from shared/client code.
4. Upgrade to Remix ≥ 2.16.3 / React Router ≥ 7.4.1 to patch CVE-2025-31137, and if you’re behind the Express adapter, validate/normalize the Host and X-Forwarded-Host headers at the proxy.
5. Add CSRF/cross-origin protection for actions — check the request origin before mutating — since actions can be triggered by cross-origin form submissions.
6. Scan the live URL and the repo before launch: enumerate your loaders/actions and hit them unauthenticated (and with a swapped id) to prove they reject you, and scan the repo for secrets that slipped into client-reachable modules.

Bottom line

In Remix, every loader and action is a public endpoint and everything a loader returns reaches the browser — so missing auth means IDOR, and an over-eager loader means leaked fields. Trust’s Remix / React Router route-extractor reads your real loaders, actions, and resource routes, probes them like an attacker (unauthenticated and with tampered ids), and scans your repo for leaked secrets and vulnerable versions like CVE-2025-31137 — free URL scan, no signup.