What 298 public v0 apps are leaking
We ran Shippable's static source checks over 298 public GitHub repos built with v0 — reading committed code only, never touching anyone's live app. The safest of the five. v0 outputs Next.js/Vercel apps that usually have no database layer, so the whole class of RLS and storage leaks mostly doesn't apply.
- 01Secrets made with Math.random() · 7.7% of appsPassword-reset tokens and API keys generated with a predictable random source an attacker can guess.high
- 02Hard-coded fallback secret · 5.4% of appsCode like process.env.SECRET || "dev-secret" that silently ships the weak default to production.high
- 03Stack traces leaked to users · 3.7% of appsErrors returned raw to the client, handing attackers table names and internals.low
- 04Hard-coded secret in source · 2.7% of appsA live secret key written directly into committed code.critical
- 05.env committed to git · 2.3% of appsReal API keys and database passwords sitting in the repo's history for anyone to read.high
Plus 18 more check types seen less often.
See which of these your app ships
Paste your app's URL. It's free, read-only, and takes about a minute.
Compare all five builders: which AI builder ships the safest apps.
How we measured this
We found public GitHub repositories carrying the v0.dev reference in the README and ran Shippable's static source checks — the same code-level checks in npx shippable — over each one's committed files. We read source only: no live app was scanned and nothing was probed over the network. Figures are the share of 298 repositories where a given check fired at least once, aggregated so no repository, owner or finding is identified.