v0 · Supabase RLS check
v0, from Vercel, generates polished React and Next.js UI fast. Most v0 projects connect to a backend — often Supabase — that you wire up yourself.
Database rules are flagged as not-tested on every URL scan — a connected repo scan reviews your migrations and policy files directly instead.
What we look at for v0
Wardloom always runs the full catalogue — these are the ones v0 projects most often get wrong, based on how the tool tends to generate and deploy code.
We look for server-only secrets used in the client, exposed dotfiles, and keys that belong behind the server wall.
AI scaffolds often put REACT_APP_ or NEXT_PUBLIC_ in front of secrets by habit. Config exposure is how private settings become public pages.
We review weak JWT secrets, missing rate limits, and insecure session patterns that show up in code and config.
Login is the front door. Soft session handling is how accounts get guessed, replayed, or shared without you noticing.
Common v0 mistakes
What a scan like this can't see
Wardloom is honest about its limits. Database rules (Firestore RLS, Supabase RLS) is not something a read-only scan can verify from the outside — it requires a connected repo scan or a manual review. A clean result means nothing visible was wrong, not that everything was checked.
FAQ