v0
Security scan for v0 apps
v0 generates Next.js applications, which means the client and server boundary is real but easy to cross by accident. A value read in a Client Component is a value shipped to the browser, regardless of what you named it.
The most common issue on generated Next.js apps is a secret referenced from a component that turned out to be client-side, or one prefixed NEXT_PUBLIC_ because that was what made the build stop complaining.
Scan your app
Or run it yourself
$pip install overshare$overshare https://myapp.vercel.app --fail-on high
What usually turns up on v0 apps
01
NEXT_PUBLIC_ prefixed secrets
The prefix does exactly what it says. Anything carrying it is compiled into the client bundle and served to every visitor.
02
Server-only keys in Client Components
Adding 'use client' to a component that reads a secret quietly moves that secret into the browser bundle.
03
Database keys from generated integrations
Generated Supabase or Postgres wiring sometimes reaches for the privileged key because it is the one that always works.
What the scan actually does
It fetches your app the way any visitor's browser would, reads the JavaScript it ships, and checks the headers, certificate and DNS records that go with it. No login is attempted, nothing is modified, and no credential is used that was not already public.
See the full check list →