Security check for v0 apps

Keep your v0 app’s secrets on the server.

Any variable named NEXT_PUBLIC_ ends up in the browser. Paste your Vercel URL: we find what a visitor can see and give you a prompt v0 can use to fix it.

First scan is free, no signup and no code access. By scanning you confirm you own this site or are authorized to test it, and agree to the Terms and Privacy Policy.

acme-launch.app · scan report
D

One key needs rotating before launch.

Built with v0 · Next.js · Vercel

Issues
5
Hardening
7
Checks
108
  1. CriticalSupabase service key is readable in main.jsJS bundle
  2. HighSource map publishes your src/ folderSource maps
  3. MediumAnyone can send email as your domainDMARC
  4. MediumSession cookie set without SecureCookies
  5. LowNo Content-Security-Policy headerHeaders

Passive external check; application logic (SQLi, IDOR) is not tested.

checks across headers, TLS, DNS, email and supply chain
100+
secret patterns searched in your JavaScript and source maps
~40
for the first scan, no signup and no code access
$0

One rename and the key is public.

  1. NEXT_PUBLIC_ fixes the error

    A generated component needs a key and fails. Renaming the variable to NEXT_PUBLIC_… makes the error go away, and puts the key in client JavaScript.

  2. No CSP by default

    Vercel does not add a Content-Security-Policy. Without one, a single injected script can do anything on your page.

  3. Client components talk to the database

    When Supabase is called from the browser, its access rules carry all the weight, exactly as in a frontend-only app.

What a scan looks at on a Next.js app

  • secretsAPI keys in your JavaScript
  • secretsPublished source maps
  • headersContent-Security-Policy
  • headersCookie flags
  • headersCORS rules
  • tlsCertificate and TLS versions
  • webMixed content
  • emailSPF record
  • emailDMARC and DKIM
  • dnsDNS records
  • dnsDNSSEC
  • recordsCertificate transparency
  • supply chainOutdated JS libraries
  • supply chainScripts without integrity
  • recordsWeb archive history

What we check on a v0 app

Where generated Next.js apps slip most often. Public checks run on every scan; Verified ones after you prove the domain is yours.

  • Secrets behind NEXT_PUBLIC_

    Payment, email and AI provider keys inlined into client chunks. About 40 key patterns, Stripe secret keys included

    Public

  • No Content-Security-Policy

    Vercel does not add one by default. We check CSP, HSTS, framing and referrer policies and weak CSP values

    Public

  • Source maps left on

    Production maps that publish your original source, and any keys inside them

    Public

  • Supabase from client components

    Whether the tables your app references answer without login, using the anon key from your bundle. One row requested, never stored

    After you verify

How it works

From URL to fixed in four steps.

  1. Paste your URL

    No code, no login, no setup. The first scan takes about a minute.

  2. Read what a stranger could do

    Each issue is explained by its consequence, in plain English, ranked by severity.

  3. Fix with v0

    Copy the fix prompt for the issue and paste it into v0.

  4. Rescan and confirm

    Verify your domain for free to unlock the deeper checks, then rescan to see the issue gone.

Free first scan. No signup, no code access.

What a stranger sees in your v0 app’s chunks.

  1. 01The chunksPublic

    NEXT_PUBLIC_ values are in the page

    Next.js writes every NEXT_PUBLIC_ variable into the JavaScript chunks it sends to the browser. We download those chunks like any visitor.

    your-app.vercel.app

    /_next/static/chunks/app/page-5d1e.js

    const url = "https://kwp.supabase.co"const anon = "eyJhbGciOiJIUzI1NiIs…"const stripe = "sk_live_51N…"fetch(url + "/rest/v1/leads", …)

  2. 02The keysPublic

    A secret key is a finding

    The Supabase anon key is fine there. A Stripe secret key is not: anyone can copy it from the chunk.

    your-app.vercel.app

    Report

    CriticalStripe secret key found in your JavaScriptsk_live_…9aQ in /_next/static/chunks/app/page-5d1e.js

  3. 03The tablesVerified

    The table the chunk calls is open

    After you verify the domain (free), we ask each table the bundle names for one row with that public key. We keep the status and column names, never the values.

    your-app.vercel.app

    Verified check

    GET /rest/v1/leads?select=*&limit=1200 OK · 1 row[{  "id": "•••",  "email": "•••",  "company": "•••"}]

    Values hidden. We store the status and column names only.

  4. 04The fixPublic

    A prompt for v0

    Each finding comes with a prompt that says what to move where. Paste it into v0, redeploy, rescan.

    your-app.vercel.app

    Fix prompt for v0

    Move Stripe calls into a route handler that reads STRIPE_SECRET_KEY on the server, and remove NEXT_PUBLIC_STRIPE_SECRET_KEY. Then enable Row Level Security on the Supabase table "leads" with no policy for the anon role.

Example data. Values in the table check are hidden.

Inside the report

A finding, and the prompt that fixes it in v0.

Every issue comes with a prompt written for the tool you build with. Paste it into v0, redeploy, and rescan to see the finding gone.

v0 security guide
your-app.vercel.appExample

Critical

Stripe secret key found in your JavaScript

A live Stripe secret key in a client chunk lets anyone create charges and read your customers.

Found in /_next/static/chunks/app/checkout/page-81c2.js

Fix prompt for v0

This Next.js app exposes the Stripe secret key through NEXT_PUBLIC_STRIPE_SECRET_KEY. I have rolled the key in Stripe. Move checkout session creation into a route handler at app/api/checkout/route.ts that reads STRIPE_SECRET_KEY on the server, update the checkout page to call it, and make sure no NEXT_PUBLIC_ variable holds a secret.

An example finding. Secret checks run on every scan.

Compared

Not instead of your other checks. Next to them.

WhatShypsetReading the code yourselfManual pentest
Where it looksYour live site, from outsideYour repositoryYour app, by a security tester
Headers, TLS, DNS, emailChecked on every scanOnly if you know to lookUsually covered
What actually got deployedThe running siteOnly the sourceThe running app
Logged-in logic (IDOR, per-user rules)Not testedIf you read for itYes
Cost and timeFirst scan free, about a minuteHours of your own timeQuoted per project, days to weeks

Not a pentest replacement before a big deal. A minute-long check of what is visible from outside, before you launch.

One URL, the whole outside view.

checks across headers, TLS, DNS and email
100+
API key patterns in your JavaScript
40+
free scans a month with an account
3
lines of your code we need to see
0

A scan takes about a minute. Table and file checks run after free domain verification.

Pricing

Your first scan is free, no signup needed. Upgrade when you want the full report and fix prompts for every issue.

Free

For your first check before launch

$0/ month

 

  • 3 scans per month
  • 1 free rescan of each scan within 7 days
  • Fix prompt for your top issue
  • Security grade and severity breakdown
  • OWASP Top 10 and CWE mapping
  • 7-day history

Pro

For founders shipping AI-built apps

$15/ month

Billed monthly, $180 a year

  • Up to 200 scans a month (fair use)
  • 1-year history
  • Full report for every issue
  • Fix prompts for Cursor, Lovable, Claude and more
  • HTML and Markdown export
  • “Scanned by Shypset” badge for your verified domain
  • Weekly monitoring with email alerts (verified domains)

Agency

For agencies and freelancers. Coming soon

Soon

 

  • More domains for client projects
  • Reports you can hand to clients
  • Need more today? Contact us

Launch Pass

$9 one-time

One domain for 30 days: the full report and every fix prompt, plus 3 rescans. The public report and badge are not included.

Questions

No. Next.js writes them into the JavaScript sent to every visitor. Use them only for values that are public by design.

Yes, if the preview is public. Vercel protects previews by default; scan your production URL or turn protection off for that deployment.

The first scan is free, with no signup and no code access. A free account gives you 3 scans a month. The full report and a fix prompt for every issue come with Pro or a one-time $9 Launch Pass.

Without verification we only read what any visitor’s browser can, plus public records such as DNS. Deeper checks, like asking your database tables for a row, run only after you verify that the domain is yours. Verification is free.

No. It is a passive external check: it does not log in and does not test application logic such as SQL injection or IDOR. A clean report means nothing is visible from outside.

v0 generated the code. We check what it left open.

Paste a URL and get the report in about a minute. First scan is free, no signup and no code access.

Ask the team behind the scanner.

Real people read every message. Tell us what you need and we will answer by email.

Questions
About a scan, a finding, or how a check works.
Agency and team needs
More domains, reports for clients, invoicing.
Security concerns
A vulnerability in Shypset, or a request not to scan your domain.

Prefer email? Write to info@softdoes.com.

Contact form

Do not paste passwords or API keys. A link to the report is enough.

We use your name, email and message only to reply to you. See the Privacy Policy.