v0 · Security scan
v0, from Vercel, generates polished React and Next.js UI fast. Most v0 projects connect to a backend — often Supabase — that you wire up yourself.
8 security checks run automatically: secrets, CORS, headers, dependencies, config exposure, auth flaws, debug artifacts, and deployment readiness.
What we look at for v0
Wardloom always runs the full catalogue — these are the ones v0 projects most often get wrong, based on how the tool tends to generate and deploy code.
We look for server-only secrets used in the client, exposed dotfiles, and keys that belong behind the server wall.
AI scaffolds often put REACT_APP_ or NEXT_PUBLIC_ in front of secrets by habit. Config exposure is how private settings become public pages.
We check whether your cross-origin rules are wide open, especially wildcards paired with credentials.
Loose CORS lets other sites call your APIs as if they were yours. Tight origin policy keeps browser traffic on the paths you meant to allow.
We look for live API keys, tokens, and credentials sitting in client bundles or source where a stranger can copy them.
One leaked Stripe or OpenAI key can empty a wallet overnight. Catching secrets before launch is the cheapest security win for vibe-coded apps.
We probe for missing CSP, HSTS, X-Frame-Options, and related hardening headers on live URLs.
Headers are cheap defenses against clickjacking, mixed content, and script injection. Search engines and browsers both notice when they are missing.
Common v0 mistakes
What a scan like this can't see
Wardloom is honest about its limits. Server-side authorization & auth logic is not something a read-only scan can verify from the outside — it requires a connected repo scan or a manual review. A clean result means nothing visible was wrong, not that everything was checked.
FAQ