For v0 builders
Security audit for v0 and Next.js apps before you launch
v0 produces polished Next.js code, and Next.js has a trap: every exported function in a `"use server"` file is a public HTTP endpoint. Generated Server Actions frequently take an id or an object from the client and act on it without checking who is calling.
VibeAudit traces each Server Action and route handler in your repo and tells you which ones anyone on the internet can call, and with what.
Scan your v0 app now — free, under a minute, no signup
Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.
What v0 apps usually ship with
From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.
`deleteProject(id)` exported from a server file can be invoked by any visitor with any id.
It bypasses RLS, so the ownership check the database would have done is gone unless the action does it explicitly.
The prefix is what makes a variable work in a client component, so the model reaches for it even for server-only keys.
A `publicPaths` list containing `/` with a `startsWith` check makes every route public.
Read before you launch
- API routes and server actions with no auth check · coming soon
- Supabase service-role and secret keys leaking to the browser · coming soon
- Trusting the client: prices, roles and scores sent from the browser · coming soon
- Missing ownership checks (IDOR): reading and editing other users' data · coming soon
FAQ
- Does it read Server Actions?
- Yes. Server Actions, route handlers, middleware, and the data layer they call are the highest-priority files in the scan.
- What about Vercel env config?
- We flag env variables referenced in code that look server-only but are exposed with `NEXT_PUBLIC_`. We do not read your Vercel project settings.