Made it with v0? Check the app you deployed.
v0 gives you a polished Next.js app quickly. What it cannot show you is how the deployed app looks to a stranger. The free scan shows your score and how many problems you have; the Full Scan adds the evidence, a fix prompt for each one, and the deeper checks (database, exposed files, HTTPS/TLS, email spoofing, admin panels) after you verify you own the app.
The 7 most common v0 problems
Secret keys in the browser bundle
Anything that is bundled into client code is public. A secret AI, payment or Supabase service key there can be copied by any visitor. The free scan checks this.
Open database tables
If your app talks to Supabase or Firebase, we check what the public key can reach without signing in. Supabase tables are rated high, and critical when they hold personal or payment data; we only count rows. Part of the Full Scan.
API routes that answer without login
A route found in your site code returns user-like data to someone who is not signed in. Part of the Full Scan.
CORS that trusts every website
An API that echoes any origin back while allowing credentials lets other sites act as your logged-in users. Part of the Full Scan.
Outdated JavaScript libraries
An old copy of a library such as jQuery, Bootstrap, AngularJS, Lodash, Moment.js or Handlebars with a publicly known security flaw, found in your page or its JavaScript files. The free scan checks this.
Weak HTTPS or email protection
HTTP that does not redirect to HTTPS, a certificate that is about to expire (rated high if it is not trusted or already expired), a missing SPF or DMARC email record (so anyone can send email that looks like it came from your domain), or an admin login page open to the public. Public source maps are reported too, as low. Part of the Full Scan.
Missing security headers
No Content-Security-Policy, HSTS or clickjacking protection. Low risk on their own, but easy to add, and they make other bugs harder to exploit. The free scan checks these.
How to fix them in v0
- 01Run a free scan to see your score, then get the Full Scan for the location and a fix prompt for each red item.
- 02Copy the fix prompt for each red item and paste it into the v0 chat, or into your editor if you took the code out of v0.
- 03Keep secret keys in server-only code and environment variables, never in client components.
- 04If a key leaked, make a new one at the provider. The old one is already out there.
- 05Redeploy, then re-scan until the light is green.
Doesn’t v0 already check this?
Builders and hosts keep adding their own checks, and you should use whatever yours offers. They look at your project from the inside. Greenlight Scan checks the live deployment from the outside and confirms the fix worked after you redeploy.
Full comparison →Questions
Do I need to give you access to my v0 or Vercel account?
No. We only need your app’s public web address.
Do you change anything in my app?
No. Every check is read-only. We only count database rows, we never download them.
Do the fix prompts work for v0?
There is a ready-made prompt for v0, plus versions for Cursor, Lovable, Bolt, Replit, Windsurf and Claude Code. They are plain instructions, so you can paste them into the v0 chat.
What does the free scan check, and what needs the Full Scan?
The free scan is passive. It reads what any browser downloads and checks it for leaked keys, security headers, cookie flags, mixed content and outdated JavaScript libraries. It shows your score, how many problems of each severity were found, and the title and why-it-matters of your top problem; the evidence, location and fix are hidden. The Full Scan unlocks every finding and fix prompt, and, after you verify you own the app, adds database and storage access, exposed files such as .env or .git, API routes that answer without login, Firebase rules, HTTPS and TLS certificate checks, SPF and DMARC email protection, open admin panels and public source maps.