v0 pre-launch checklist

37 checks in the order we run them, most severe first. Each one has a self-check you can do in the v0 dashboard and your browser, and a fix direction. Free to use; nothing to sign up for.

Download .md

Defaults referenced come from Vercel's documentation, verified 2026-09-21, on the v0 hub.

Secrets and keys
- NEXT_PUBLIC_ prefix on a secret
  In your hosting dashboard (Vercel: Project, Settings, Environment Variables) or your .env files, list every variable whose name starts with NEXT_PUBLIC_.
  Critical
- Secrets committed to the code repository
  Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  Critical
- Service-role key shipped in the browser bundle
  Open your live app in Chrome, right-click anywhere and choose Inspect, then open the Sources tab.
  Critical
- Third-party API key in the JavaScript bundle
  Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
  High
- Secrets and internals in error messages and logs
  Open your live app, right-click, choose Inspect, then the Network tab. Trigger an error on purpose: submit a form with a field left blank, or visit an address like /api/anything-made-up.
  High
Data access
- Record ids accepted without an ownership check
  Create two accounts in your app and add one record, such as an order or a note, in each.
  Critical
- Any signed-in user can read every row
  In the Supabase dashboard open Authentication, then Policies. Row Level Security (RLS) is the per-row access rule set Postgres applies to each query, and this page shows each policy's expression.
  Critical
- Row Level Security disabled on a table
  In the Supabase dashboard open Table Editor. Tables without Row Level Security (RLS, the per-row access rules Postgres applies to each query) show an RLS disabled or Unrestricted label next to the name.
  Critical
- RLS policy that allows everything with using (true)
  In the Supabase dashboard open Authentication, then Policies. Row Level Security (RLS) is the per-row access rule set Postgres applies to each query, and this page lists every policy per table.
  Critical
- Uploaded files in a public storage bucket
  In the Supabase dashboard open Storage and look for the Public label on each bucket; in Firebase open Storage, then the Rules tab.
  High
Login and permissions
- Admin routes without any login check
  Open a private browsing window so you are signed out.
  Critical
- Authorization enforced only in the browser
  Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
  Critical
- Tokens trusted without server verification
  Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie.
  Critical
- Role chosen by the client at signup
  Open your signup page, open developer tools (right-click, Inspect) and the Network tab, then submit the form with a test email.
  Critical
- Sessions that survive logout and password changes
  Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
  High
Payments
- Stripe webhook accepted without signature verification
  In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.
  Critical
- No idempotency on payment handlers
  In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account.
  High
- Price or plan taken from the client
  Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.
  High
- Subscription state trusted from local storage
  Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
  High
- Stripe test keys in production
  Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_.
  High
AI features
- LLM API key exposed to the client
  Open your live app, press F12, select the Network tab, and use the AI feature once.
  Critical
- No output validation before actions
  List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code.
  Critical
- No spend cap on model calls
  Sign in to your model provider's console and open the billing or limits page (OpenAI: Limits; Anthropic: Settings, then Billing). Note whether a monthly spend limit and a spend alert are set.
  High
- Prompt injection through user content
  List every place where text from a user, a webpage, an uploaded file or an email reaches the model: chat boxes, ticket forms, document upload, URL summarisers.
  High
- Unbounded input length to the model
  Open the AI feature in your app and paste an unusually long text, for example a whole book chapter copied several times, then submit.
  Medium
Reliability
- No rate limiting on sensitive routes
  Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
  High
- Background jobs that fail silently
  List every scheduled or background task your app has: on Vercel open Settings then Cron Jobs; on Supabase open Integrations then Cron, and Edge Functions; on Replit look for a Scheduled deployment.
  Medium
- Errors swallowed, spinner never stops
  Open your app in Chrome and sign in as a normal user.
  Medium
- Retries with no pause and no cap
  Open your app in Chrome, press F12 and choose the Network tab.
  Medium
Data integrity
- Race conditions on counters and balances
  Open the app in two browser tabs signed in to the same test account that has a limited balance, seat count or single-use coupon.
  High
Deploy and config
- Dependencies with known vulnerabilities
  If your builder shows a package.json file or lets you export the code, open a terminal in that folder and run npm audit (or pnpm audit or yarn audit).
  High
- No automated checks before deploy
  Open the project's GitHub repository; if the builder has a GitHub sync, connect it first so the code is visible there.
  Medium
- Every change goes straight to production
  Open your hosting dashboard (Vercel: the Deployments tab) or the builder's publish panel and look at the recent deployments.
  Medium
Performance
- No index on the columns you filter by
  In the Supabase dashboard open Advisors, then Performance Advisor, and read the list of suggestions.
  Medium
- One database query per list item
  Open a page in your app that shows a list (orders, projects, customers) in Chrome, press F12, choose the Network tab and filter by "Fetch/XHR".
  Medium
- List endpoints that return everything
  Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  Medium
- Whole table downloaded, filtered in the browser
  Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  Medium

Questions

v0 security checklist

The list above: 37 checks across 9 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.

can i use this checklist without buying anything

Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.

Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.

v0 pre-launch checklist

Secrets and keys

Data access

Login and permissions

Payments

AI features

Reliability

Data integrity

Deploy and config

Performance

Questions