for v0 and Next.js

v0 app security check

No signup 路 no repo or GitHub access needed 路 passive, read-only checks 路 results in under a minute

See a sample report

Built your app with v0? Paste your live link and check what your Next.js app ships to the browser. Under a minute, no sign-up.

Only scan apps you own or have permission to scan.

why.txt

What to watch in a Next.js app

In Next.js, any environment variable starting with NEXT_PUBLIC_ is bundled into the browser code. Put a secret key there and it's public.

Public source maps and missing security headers are two more common gaps.

what_we_check.log

What the free scan checks

  • Leaked keys in your frontend

    Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.

  • Supabase service_role key

    A Supabase service_role key in your client code is flagged as critical. That key skips Row Level Security entirely.

  • Files left on the server

    Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.

  • Public source maps

    We check whether a source map for one of your JavaScript files can be downloaded, which would expose your original source.

  • Security headers and CORS

    HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.

checklist.txt

Next.js pre-launch checklist

  1. Audit NEXT_PUBLIC_ variables. Only values that are safe to publish should use that prefix.
  2. Call paid APIs from route handlers. Keep secret keys in server-only environment variables.
  3. Keep production source maps off. productionBrowserSourceMaps should stay false.
  4. Add security headers. Set them in next.config.js headers() or your host config.
  5. Run the free scan. Fix anything critical or high first.
faq.txt

FAQ

Does it also check my Next.js version?
When the version can be read from public files, it's compared against known vulnerable releases. That result is based on version only.
Do I need to sign up?
No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
What does it cost?
The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
Does it attack my site?
No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
What doesn't it check?
Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.

Run the free scan