Is my v0 app safe to launch?

What v0 already does for you

• Publishing from v0 creates a Vercel project with a production URL, usually ending in vercel.app. You can connect a custom domain later.
• v0 adds databases like Supabase, Neon, and Upstash through the Vercel Marketplace. The Supabase integration adds both a public publishable key and a server-only secret key to your project.
• In Next.js, any environment variable starting with NEXT_PUBLIC_ is sent to the browser. Vercel says v0 blocked more than 17,000 deployments in one month because of exposed secrets.

v0 and Vercel check your code before deploy. Throttle Bird checks the live result from the outside: what's in the page a visitor downloads, your headers, HTTPS, previews, and whether your database answers the public key.

6 checks before you share the link

1. 1. No secrets in NEXT_PUBLIC_ variables

   Why it matters: These are baked into your JavaScript. A secret here is readable by anyone who opens your site.

   How to check: Open your project's environment variables in v0 or Vercel. Only truly public values (like NEXT_PUBLIC_SUPABASE_URL and the publishable key) should have the prefix.

   Fix prompt to paste into v0

   Copy prompt

   List every NEXT_PUBLIC_ environment variable. Move any secret (API keys for OpenAI or other AI providers, SUPABASE_SECRET_KEY, database URLs, Stripe secret keys) to server-only variables and use them only in server code or route handlers.

2. 2. API routes require login

   Why it matters: Unauthenticated API routes are one of the most common problems Vercel sees in v0 apps.

   How to check: For each route handler, ask: what does a logged-out stranger get if they call it directly?

   Fix prompt to paste into v0

   Copy prompt

   Check every route handler and server action. Each one that reads or changes user data must verify the signed-in user on the server and only touch that user's data. Add rate limiting to routes that call paid APIs.

3. 3. Supabase row-level security is on

   Why it matters: The publishable key in your page is public by design. Row-level security is what stops it from reading everyone's data.

   How to check: In the Supabase dashboard, check that RLS is enabled on every table and that policies limit rows to their owner.

   Fix prompt to paste into v0

   Copy prompt

   Enable row-level security on every Supabase table and add policies so users can only read and change their own rows. Never use the secret key in client components.

4. 4. Public keys are locked to your domain

   Why it matters: Vercel says the keys v0 apps most often nearly leaked included Google Maps, reCAPTCHA, EmailJS, and PostHog. Some of these are meant to be in the page, but an unrestricted one can be used by anyone, on your bill.

   How to check: In each provider's dashboard, restrict the key to your live domain (for Google, that's API key restrictions in Google Cloud).

   Fix prompt to paste into v0

   Copy prompt

   List every third-party key used in the browser. For each one, tell me whether it's meant to be public, and which dashboard setting restricts it to my domain.

5. 5. Previews stay private, production is ready

   Why it matters: Preview links can show half-built features. Your production link is the one people will share.

   How to check: Check who can open your preview links, and connect a custom domain under Settings → Domains if you have one.

   Fix prompt to paste into v0

   Copy prompt

   Add a unique title and meta description to every page, Open Graph tags with a 1200x630 image, a robots.txt, and a sitemap so my production link looks finished when shared.

6. 6. Security headers

   Why it matters: Headers like Content-Security-Policy and Strict-Transport-Security block common browser attacks.

   How to check: Run the free scan to see which ones are missing.

   Fix prompt to paste into v0

   Copy prompt

   Add security headers in next.config: Content-Security-Policy with frame-ancestors 'none', Strict-Transport-Security, X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy.

What the free scan checks on your live v0 app

• Secret keys sitting in your page or its JavaScript files (Stripe, OpenAI, Anthropic, Supabase secret and service_role keys, GitHub, AWS, Google, private keys).
• If your page already exposes its Supabase or Firebase settings, one read-only test with the public key to see if a stranger can read your tables. Rows are never stored.
• Missing security headers that block injected scripts and click-jacking.
• A rate-limit hint on up to two /api/ routes found in your code (one normal request each, not a load test).
• HTTPS, certificate expiry, and whether plain http:// redirects to https://.
• Page title, description, link-preview tags, robots.txt and sitemap.
• How fast the page loads, page size, and JavaScript files that fail to load.

The scan only reads your public site. It never logs in, submits forms, or changes anything. It can't see inside your v0 project, so it doesn't replace testing sign-up and payments yourself.

Scan my v0 app free

Questions

Can I scan a vercel.app link?

Yes, if it's public. Paste your production URL or custom domain.

v0 already blocks exposed secrets. Why scan?

v0's checks are a good safety net. Throttle Bird is a second, outside look at the live site, and it also checks headers, HTTPS, database access with the public key, and link previews.

Does the scan log in or change anything?

No. It only reads public pages and never submits forms or writes data.