> We intentionally do not support 'use server' actions, both because of existing attack vectors and because they can create highly implicit network boundaries

Mmm. Very nice.

Explicitly avoiding turning react into “webforms” and focusing on the actual point of RSC seems like the path RSC should have had from the beginning.

Magical RPC so you could “use server” and not bother to write an API properly was never the point of RSC, and the CVEs showed why it was a bad idea.

Though I don't see it nearly as much as I did then, there were quite a few "you'll never have to write an api again" takes that haven't aged too well.

When RSC's were framed as a different way to write BFF's, it finally clicked for me.