I asked in terms of security

and is it stable?

hey there, do you mean using it in a server component?

if the fear is that you might expose some server code to the client, try the technique here: https://nextjs.org/docs/app/building-your-application/rendering/composition-patterns#keeping-server-only-code-out-of-the-client-environment

i.e.

adding that to the top of your files you want to ensure only run on the server

the app router is now stable, so should be ok - all the code in server components (i.e. components without "use client") run on a nodejs or serverless runtime (i.e. always on the server)

+1 but i just want to make it clear that even with "use client" it is run on server for ssr just it is also on client + things that client component imports is client (ie why you'd use server-only)