I think it really depends on what specifically you're building. If your app has a lot of user interaction, needs some kind of state and has a lot of bespoke fu

I think it really depends on what specifically you're building. If your app has a lot of user interaction, needs some kind of state and has a lot of bespoke functionality then I'd lean towards Next.js. I've worked with Gatsby in the past and have great experiences, especially for things like developer documentation, blogs and anything with a lot of static content. If that's what you're optimizing for then Gatsby is your best bet IMO. Re: security — if your app is stateless, I think the attack surface is reasonably small assuming your production codebase and host is secured. The headless CMS you pick is going to be the most important thing to protect. Data breaches, CSRF and session hijacking are going to be less significant in this case. I think the most important thing to keep in mind is that the experience your users enjoy and see is almost certainly not going to be just as a result of the framework you pick. No matter which framework you use, the way you craft designs, layouts and experiences is the most important thing.