Is my v0 app secure?

Q: How do I know if a v0 env variable is public?

In Next.js, anything starting NEXT_PUBLIC_ is sent to the browser. Everything else is only available to server code. Paste a key prefix into our key checker if you're unsure what it is.

A v0 app can be secure, but v0 doesn't add a security layer for you: it generates a Next.js app, and your data is only as safe as your database's access rules and how your environment variables are split between server and browser. The usual problems are secret keys in NEXT_PUBLIC_ variables, Supabase tables without Row Level Security, and route handlers or server actions that don't check who's calling.

Run a free, read-only scan of your v0 app to see where you stand. It takes a couple of minutes once you've proved you own the app.

How v0 apps are usually built

v0 generates Next.js apps (React, TypeScript, Tailwind and shadcn/ui) and publishes them to Vercel.

Databases are usually added through Vercel Marketplace integrations such as Supabase, Neon, Upstash or Vercel Blob, which write the connection details into your environment variables for you. Those variables can include both a public key and a server-only secret, so check which is used where.

Environment variables are managed in the project settings, per environment. Next.js inlines any variable starting NEXT_PUBLIC_ into browser JavaScript; everything else stays on the server.

v0's own security tools

v0 works through pull requests rather than pushing straight to your main branch, which gives you a chance to review changes.

We didn't find a built-in security scan of your generated app in v0's docs (October 2026), so reviewing access rules, env variables and routes is on you, or on an outside scan.

Common risks in v0 apps

Secrets in `NEXT_PUBLIC_` variables

Anything with the NEXT_PUBLIC_ prefix is shipped to every visitor. Only public-by-design keys belong there: a Supabase anon key, a Firebase web config or a Stripe publishable key.

Supabase tables without Row Level Security

If client components query Supabase, every table they can reach needs RLS with owner-based policies. Run the RLS audit SQL to see where you stand.

The service role key in a client component

The Supabase service_role key bypasses every policy. It must only be read in server code (route handlers, server actions, server components), never in a file marked "use client".

Route handlers and server actions without auth

Both are public endpoints that can be called directly. Each one needs to check the session and permissions before reading or writing data.

Preview deployments with production data

Preview URLs are easy to share and forget. Use separate environment variables per environment so previews don't point at production data with production secrets.

What SealMyApp's scan checks

Searches your live JavaScript for secret keys, including anything that came through a NEXT_PUBLIC_ variable (Stripe, OpenAI, Anthropic, AWS, Supabase service role and more).
If the browser talks to Supabase or Firebase, tests what an anonymous visitor can read, fetching at most one row to confirm and keeping only table and column names.
Checks for exposed .env, .git and source-map files.
Probes common admin and API paths for responses that don't need a login, and reviews security headers.

We check from the outside, the way a stranger would, and never sign in, so problems that only show up for logged-in users (one user reading another's data, for example) aren't visible to us. A clean result means our checks found nothing, not that your app is guaranteed secure.

Quick checklist

Only public-by-design keys in NEXT_PUBLIC_ variables.
The Supabase service role key is only used in server code.
RLS is on for every Supabase table, with owner checks.
Every route handler and server action checks the session.
Preview and production use separate data and secrets.
Review v0's pull requests before merging changes that touch auth, payments or data access.
Re-check after big changes.

FAQ

Is it safe that my Supabase URL and anon key are in my v0 app?

Yes, those are designed to be public. Your data is protected by Row Level Security, so that's what to check. See is my Supabase anon key safe to expose?

How do I know if a v0 env variable is public?

In Next.js, anything starting NEXT_PUBLIC_ is sent to the browser. Everything else is only available to server code. Paste a key prefix into our key checker if you're unsure what it is.

Does Vercel protect my app's data?

Vercel hosts and serves your app; who can read your data is decided by your app's code and your database's access rules.

Can you scan a v0 app on a vercel.app address?

Yes, if you can prove you own it. On a shared domain use the file method: serve the token at /.well-known/sealmyapp.txt.

Go deeper

Sources

v0 details were checked against the official docs on 2026-10-16. Builders change their products often, so check the current docs if something here doesn't match what you see.

One common security mistake in AI-built apps, how to fix it in your builder, and one useful tool. No spam; unsubscribe any time.