Mutable module state in server code
Why it matters
A module-level variable lives as long as the server instance and is shared by every concurrent request: one user's data can leak into another's response.
Fix
Keep per-request data in arguments, cookies or React cache(); use a real store for shared state.
Credit
From Vercel
The react-best-practices skill warns against shared mutable module state on the server because concurrent requests see the same variables.
References
- react-best-practices: Avoid shared module stateVercel (vercel-labs/agent-skills)
- cache — ReactReact
- How to think about data security in Next.jsNext.js