Server Actions are the nicest way to write mutations in Next.js. You write an async function, mark it "use server" , pass it to a form, and you're done: no API route, no fetch call, no loading-state plumbing.
That convenience hides one fact you need to keep in mind every time: each exported Server Action is a public HTTP endpoint. Anyone can call it with a POST request, from anywhere, with any arguments, whether or not your UI shows the button.
On real products I've moved sensitive oper...