v0's documentation defaults to the Next.js App Router — "Next.js provides the most reliable results" — using React Server Components, Server Actions and API routes. Environment variables are server-only unless you explicitly prefix them NEXT_PUBLIC_.
That shape matters more than any scanner. In a browser-direct architecture, the database is reachable by anyone holding the public key, so the access rules are the only control. On a default v0 app the browser can only call the server functions you chose to expose. You can still write a broken server action — but you have to write it, rather than inherit it.
These are real protections no application-level scan replaces, and a genuine argument for a hosted platform over rolling your own.
supabase.co or firebaseio.com. On a properly server-rendered v0 app you should find nothing. If you do find a project URL and an anon key, your app is browser-direct after all — and you need the Row Level Security checks immediately.NEXT_PUBLIC_ prefix is a loaded gun: it ships the value to every visitor. DevTools → Sources → search for NEXT_PUBLIC_, sk_live_, service_role. Anything sensitive with that prefix is public.All four, automatically. Broid tests your live v0 deployment from outside — headers, TLS, exposed secrets, and whether anything is reachable that shouldn't be. Free grade, no signup.
Scan my app free →Worth knowing rather than being alarmed by. Vercel disclosed an April 2026 incident that began with the compromise of a third-party AI tool used by an employee and led to exposure of environment variables — API keys, tokens, database credentials — for a limited subset of customers. Separately, CVE-2026-23869 (CVSS 7.5) affected Next.js server function endpoints across versions 13 to 16.
Neither means Vercel is careless; every platform ships bugs and both were disclosed and fixed. The pattern worth noticing is that these were found and reported externally. That's the argument for an independent check in one line — not that platforms are bad at security, but that nobody reliably audits their own work.
Every major AI builder ships security scanning now, so that's not the differentiator — architecture is, and v0's is the most defensive of the group by default. We compared all five with sources, including where each one's blind spot sits.
They start better placed than most, because v0 defaults to Next.js server components — so the browser cannot reach your database directly, and one missing database policy isn't immediately catastrophic. That's a default rather than a guarantee: v0 supports Supabase, and a browser-side client can be wired up, at which point you inherit the same exposure as any other builder.
Yes. Vercel has applied security checks during generation and before deployment since August 2025, and reported blocking over 17,000 deployments for exposed secrets in a single 30-day window. Vercel also runs automatic secret scanning that revokes leaked Vercel and v0 credentials found in public repositories.
It tells Next.js to include that environment variable in the client bundle, meaning it is shipped to every visitor and readable in DevTools. It's correct for genuinely public values like a publishable key, and dangerous for anything else. Search your bundle for the prefix and check every value you find is one you'd happily print on your homepage.
Partly. DDoS mitigation is automatic on all plans, and HTTPS and TLS are on by default. The configurable web application firewall is a paid add-on. Neither protects against application-level problems — a server action that doesn't check ownership, or a secret shipped to the browser, is unaffected by any firewall.
Authorization in server actions — knowing who the user is, but not checking what they're allowed to reach. Research on agentic coding tools found them very prone to business logic and API authorization flaws while producing almost no classic injection bugs. Change an id in a request and see whether you get back someone else's record.
The four checks above need nothing but your browser. For an automated version, Broid grades any live URL A–F in seconds with no signup, testing headers, TLS, exposed files and secrets, cookies and whether anything is publicly reachable that shouldn't be.
Paste your URL and get an A–F grade in seconds. Works on any stack, not just Next.js.
Scan my app freeBroid is independent — we don't build apps, so we have no reason to tell you yours is fine.