An exhaustive architectural analysis of Server Actions security model, public POST endpoint exposure, cryptographic session verification, and single-use transaction nonces. Specifically investigating securing next.js server actions against unauthorized direct invocations, csrf exploitation, and replay attacks.