Server Actions are the nicest way to write mutations in Next.js. You write an async function, mark it "use server" , pass it to a form, and you're done: no API route, no fetch call, no loading-state plumbing. That convenience hides one fact you need to keep in mind every time: each exported Server Action is a public HTTP endpoint. Anyone can call it with a POST request, from anywhere, with any arguments, whether or not your UI shows the button. On real products I've moved sensitive oper...