v0

v0 generates the UI. The deploy is what we scan.

A component that never shipped is invisible. The public URL is the page, its same-origin scripts, and the headers that host sends.

• Keys left in generated client code

  Generated components sometimes keep a token in the file that gets bundled. The scan looks for the same secret shapes it uses on every other URL.

• A deploy without security headers

  CSP, HSTS, nosniff, Referrer-Policy, and framing protection are read from the document response. Permissions-Policy is only a note.

• Launch files and broken homepage links

  robots.txt, sitemap.xml, the title, the meta description, and up to 25 same-origin homepage links are part of the same pass.

We do not open the v0 chat. The free scan is the list. Monitor at $9/mo emails a weekly summary with the grade and what is new or fixed.