Data encrypted in transit (TLS 1.2+)

CMMC 2.0 SC.L1-3.13.8 (NIST 800-171r2 3.13.8) requires that FCI be encrypted during transmission. Any HTTP connection — even for a redirect — transmits cookies, session tokens, and form data in cleartext readable by network observers on shared Wi-Fi, corporate proxies, or compromised routers. The absence of HSTS means browsers will accept HTTP connections rather than insisting on HTTPS, allowing SSL stripping attacks. CWE-319 (Cleartext Transmission of Sensitive Information) and OWASP A02 (Cryptographic Failures) both apply. CMMC assessors treat missing HSTS as a direct compliance gap for SC.L1-3.13.8.

Configure HSTS with a two-year max-age and includeSubDomains in next.config.ts. The header must be served on every response — not just the login page:

// next.config.ts
const nextConfig = {
  async headers() {
    return [{
      source: '/:path*',
      headers: [{
        key: 'Strict-Transport-Security',
        value: 'max-age=63072000; includeSubDomains; preload',
      }],
    }]
  },
}
export default nextConfig

Replace all hardcoded http:// URLs in production code with https:// equivalents or environment variables:

// Use an env var — guarantees correct protocol per environment
const API_URL = process.env.NEXT_PUBLIC_API_URL ?? 'https://api.example.com'

On non-Vercel hosts, add a server-level redirect from port 80 to 443 and configure ssl_protocols TLSv1.2 TLSv1.3 in your nginx or Apache config. Vercel enforces HTTPS automatically; the HSTS header is still required for browser-level enforcement.