AppLeakWatch
Security scanner for apps built with v0
v0 generates polished interfaces quickly. Once they're connected to real data and deployed, AppLeakWatch checks what they expose.
What usually goes wrong
NEXT_PUBLIC settings holding secrets
Anything starting with NEXT_PUBLIC_ is sent to every visitor's browser.
API routes with no login
Next.js routes are public unless your code checks who's calling them.
Published source maps
Source maps can reveal your original code and comments.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.