Built with v0

Is your v0 app safe?

v0 built it and Vercel runs it. Enter the address and we ask your app what a stranger would ask it. No account needed.

What the free check asks your app

v0 builds Next.js apps and publishes them on Vercel at a vercel.app address. Data comes in through integrations such as Supabase, Neon and Upstash.

Are secret keys or passwords in what browsers download?
What could happen Anyone can read the key in their browser's tools and use it, so treat it as already known and replace it.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free checkHow we check
Can your database tables be read without signing in?
What could happen Anyone can download those tables in full.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKCritical at worstHow we check
Do your pages ask browsers to protect them?
What could happen Injected code runs unchecked, or a visitor is tricked into clicking something they cannot see.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free checkMedium at worstHow we check
Does your API answer requests from any website?
What could happen A page your signed-in user visits reads or changes their data without them knowing.
On 16 cases it had never seen, it found 6 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKHigh at worstHow we check

Your app lives on v0’s domain until you give it one of your own. That changes three things.

The first check runs every question above, on the tick you give it, and shows each finding’s title and how serious it is at once.
For the checks that need your OK, where a finding sits and how to fix it open once you confirm your domain. That takes one DNS record, so it needs a domain of your own instead of your-app.vercel.app.
On your-app.vercel.app we skip the checks of your email records and of subdomains others could claim, because those belong to v0.

Some mistakes only show in the code. On a paid plan we read your repository too.

Are private keys named so they ship to the browser?
What could happen Anyone takes the key from your site and runs up your AI or email bill in your name.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Paid plan, your repositoryHigh at worstHow we check
Can strangers use your AI features on your bill?
What could happen Anyone uses your app as a free AI service and runs up your provider bill.
Paid plan, your codeHigh at worstHow we check
Can anyone tell your app a payment went through?
What could happen People get paid features for free or for less, or real payments fail to count.
Paid plan, your codeCritical at worstHow we check

v0 warns you when your code uses NEXT_PUBLIC_ variables in a risky way. We ask the app you published, from the outside, the way a stranger would.

While you build

Reads your project in the editor, before it goes out.

Vallit

Once it is live

Asks the published app from the outside, then again every day.

Both are worth having. Theirs reads your project while you build. Ours checks the live app again every day, and our team can fix what it finds.

We wrote 80 cases these checks had never seen, half broken and half safe, and scored each set once.