v0 turns a prompt into a polished Next.js page with shadcn/ui components faster than most teams can agree on a color. It is very good at the part you can see.
I review the part you cannot: server actions, route handlers, environment variables and the line between server and client. You get a ranked list of what to fix, with a fix prompt for each finding you can paste back into v0 or your editor.
1'use server'23exportasyncfunction updateProfile(formData: FormData) {
4const id = formData.get('id') as string
5const name = formData.get('name') as string
6await db.update(users).set({ name }).where(eq(users.id, id))17 revalidatePath('/settings')
8}
1Line 6: A server action is a public endpoint; this one renames whichever user id the form sends, with no check that it belongs to the person submitting.
Common problems in v0 apps
Not every app has all of these. The report tells you which ones yours has, where, and what to do about each.
Critical
Server actions anyone can call
A server action your app uses anywhere is a public HTTP endpoint that anyone can call with a POST request, not just your form. Ones generated from a UI prompt tend to take an id and update the record, with no check on who is asking. I list each action and what it lets an outsider do.
High
Secrets promoted to NEXT_PUBLIC_
When a fetch in a client component needs a key, the fastest way to make it work is to add the NEXT_PUBLIC_ prefix. Now the key is in the JavaScript bundle. I find each one, tell you which to rotate, and show you how to move the call to the server.
High
Data fetched in the browser that belongs on the server
Client components that call your database or a third-party API directly, or fetch an entire table and filter it in React. Both send data you did not mean to send and keys you did not mean to share.
Medium
'use client' at the top of everything
When a component needs one onClick, the whole page becomes a client component, and with it the data fetching, the imports from server-only modules and the bundle size. I show you where to redraw the boundary so the server does the server work.
Medium
Forms validated in the browser only
A zod schema in the form component, and a server action that reads FormData and trusts it. The schema needs to run on the server, where it cannot be skipped. I show you where to move it.
Low
Placeholder data shipped to production
Hard-coded product arrays, placeholder images and sample users left in lib/data.ts from the first prototype. Some pages still read from them. I find what is real and what is not.
Treatment plan
How it works
1
Book a check-up
Choose a tier and tell me where to send the report. Add your app's address if it is live. Two minutes, no sales call.
2
Show me your code
Pay by card, then give me read-only access to your code on GitHub (you paste in a key I send you) and let me into your app with test accounts. Never done that? I send you step-by-step instructions for your tool. I measure your app and confirm it fits before I start.
3
Get your diagnosis
Ready to launch, or not yet. Problems ranked, critical ones proven on your live app, each with a prescription for your AI tool. A PDF by email, then 7 to 30 days of questions by email.
4
Fix it, then a free follow-up
Fix the problems yourself, with your AI, or let me do it with the Fix Pack. Tell me within 30 days and I check once more that they are really gone.
No idea how big your app is? That’s normal, and you never have to count anything. Book the review you want; I measure your app before I start and tell you. If it doesn’t fit, you choose: upgrade, narrow it down, or a full refund. “Lines of your code” means the code you and your AI wrote, not the packages and UI kit your tool installed; many apps built with Lovable, Bolt or v0 fit the Safety Scan.
Start small, upgrade later. The Safety Scan’s price counts in full toward a Launch Review or Fix Pack for the same app within 30 days of your report.
Why this price? Software does the first pass, so you pay for the part only a person can do: checking every finding in your code, proving the critical ones and deciding what matters for your app. I take at most 3 Safety Scans and 2 Launch Reviews (or one Fix Pack) a week; if this week is full, yours starts the next.
Prices in US dollars, paid once, no sales call and no surprise invoice: anything extra is your choice, told to you before I start. The clock starts when I can see your code. Reports arrive as a PDF by email, in English, or German if you prefer.
Need a few things fixed after a scan? I fix by the hour at $199, three hours minimum, with the list agreed before I start.
Bigger than 50k lines, or a real mess? Rescue jobs are quoted, from $3,000, no obligation. Email me.
Not for you if
you have a team of engineers who already review each other’s code,
your app’s backend isn’t JavaScript or TypeScript (Python Replit apps, for example), or it is over 100k lines,
you handle regulated data (health records, banking, children), or need a pentest, certificate or compliance sign-off. Taking card payments through Stripe is fine.
A review lowers your risk a lot. It can’t guarantee that your app is secure, and nobody honest will say otherwise.
v0 questions
How do I share a v0 project?
Download the project from v0 or push it to a GitHub repository, then give me read-only access (I send you a key to paste in; it takes a minute). If it is deployed on Vercel, also send me the names (not values) of the environment variables set there, so I can check which ones are public.
Do you review only what v0 generated or the whole app?
The whole app. Many v0 projects keep growing in an editor after the first few prompts, and the problems are usually in the seams between what v0 wrote and what was added later.
Can I apply the fixes in v0?
For UI and component changes, yes, each finding has a fix prompt. For server actions, auth and environment variables you are better off running the prompt in Cursor or Claude Code on the full repository, and I write it with that in mind.
Why not just ask my AI to review it?
Do, and I will even give you the prompt. You will get a long list. What your AI cannot do is tell you which items are real, prove them against your live app, see your database and hosting settings, or check that its own fixes worked. If you cannot read code, that is the part you cannot do yourself either. It is what you pay me for.
I'm not a developer. Is this for me?
Yes, that is exactly who it is for. If you built an app with AI and cannot tell whether the code is any good, I check it and explain what matters in plain English. You never need to understand the code to act on the report: every problem comes with a prompt you paste into your AI tool. And you do not need to know what to ask. The report answers the questions you would have asked if you knew how.
How do I show you my code?
Most AI builders can push your app to GitHub, a free site that stores code. You give me read-only access by pasting a key I send you into your repository settings, which means I can look but not change anything. Never done it? After you book, I send you step-by-step instructions for your tool. A zip file works too. When the report is delivered, remove my access again; I remind you.
Is my code safe with you?
Every booking comes with an NDA, automatically. I never sell, publish or pass on your code. The only other party that sees it is the AI provider that helps with the first pass, under terms that do not allow it to train on your code. I never need your passwords or your live database, and I delete my copy within 7 days of delivering the final report.
From $149 for the first 10 customers (10 left). Ready within 2 business days. If the Safety Scan finds no problem rated medium or worse, you pay nothing.