View Source shows the data you deleted from the screen
Next.js embeds server data in the HTML your browser downloads. Hide a field in React and it can still sit in page source, readable with View Source and no login.
What can go wrong
In Next.js, data you fetch on the server often travels to the browser as props (inputs passed into components).
Pages Router: getServerSideProps or getStaticProps return { props: { users: [...] } }. Next.js serializes those props into a <script id="__NEXT_DATA__"> tag in the HTML. Anyone can read that JSON.
App Router: props passed to a Client Component (even props the component never uses) are serialized into <script>self.__next_f.push(...)</script> tags at the bottom of the page. Same exposure, different marker.
Removing a column from the UI does not remove it from the serialized payload. A grant ID, email list, or internal note can leak to every visitor who views source.
It happened for real
A US government website removed grant IDs from the visible UI but left them in the Next.js RSC hydration payload. The leak was covered by the New York Times and dissected at bswanson.dev (2026), with the self.__next_f.push marker visible in page source.
Next.js documents the mechanism: Client Component props are included in generated HTML even when unused (Next.js security blog).
How to check yours
Seatbelt flags this automatically (partial, URL scan). On a live URL Ship Read, we parse served HTML for PII in __NEXT_DATA__ and App Router RSC flight payloads (self.__next_f.push). Emails, phones, password hashes, or SSN-shaped fields in those blobs are soft customer_data flags.
Honest holes: repo scans do not yet walk every getServerSideProps return in your source export. Props that never appear in the build you hand us are invisible to a folder scan.
Ask your agent: "List every getServerSideProps, getStaticProps, and Server Component that passes user rows to a Client Component. Map each field. Remove anything not needed for display."
Manual check: open your deployed page, View Source (Ctrl+U or Cmd+Option+U), search for __NEXT_DATA__ or self.__next_f.push, and read the JSON for emails, names, or internal IDs.
Fix direction
Return only display fields (a DTO), not whole database rows. For App Router, use React taintObjectReference or taintUniqueValue on sensitive objects so the framework blocks accidental serialization.
Paste into your agent: "Audit SSR and RSC props for PII. Strip props to display-only fields before passing to Client Components. Add taint calls on sensitive server objects per Next.js docs."