Why v0 apps leak secrets
v0 is strong at generating polished UI and wiring it into a Next.js project. One security detail is easy to miss there: environment variables prefixed to be public are deliberately shipped to the browser. That is correct for a public analytics ID, but wrong for a database URL or an API secret. When a real secret is given a public prefix, it goes out with every page load.
This is not visible from a scan of the deployed site alone, because the value looks like normal app data once it is bundled. ShipSafeScan reads the repository, so it can flag a secret that was marked public or committed to a config file, and show you exactly where it lives.
The output is a reproducible score and a focused issue list. Confirm that only non-sensitive values carry a public prefix, keep real secrets server-side, and re-scan after each change to verify the fix.
Common v0 security mistakes
Real secrets behind a public env prefix
A public-prefixed variable is shipped to the browser on purpose. Reserve that prefix for values that are safe to expose, and keep secrets in server-only variables.
Keys in client components
A key used directly in a client component is readable by any visitor. Call the external service from a server route instead.
Config files with credentials committed
Connection strings or keys pasted into a config file stay in the repo and its history. Move them to environment variables and rotate what was public.
Source scan vs live-site scan
Some checks only look at your deployed site. That view misses two things that matter for a v0 project: files that never render in the browser, and your Git history. A secret can be gone from your live app and still sit in an old commit in a public repo. ShipSafeScan reads the repository source, so it can flag those cases and point you at the exact file and line.
v0 security: frequently asked questions
How do I check if my v0 app exposed a secret?
Paste your public GitHub repository URL into ShipSafeScan. It scans the source for secrets, including values exposed through public environment prefixes, masks what it finds, and reports it so you can rotate and relocate them.
Are public-prefixed environment variables safe in v0 apps?
Only for values that are meant to be public, such as a site URL or a public analytics ID. Any real secret with a public prefix is shipped to the browser and should be moved to a server-only variable.