V0: Security Review for Your Code Changes

V0View original changelog

V0 introduced Security Review, a feature that checks code for issues such as missing auth checks, injection, and SSRF. It reviews the code the chat changed, or the riskiest code in the project when nothing changed, and verifies each finding against the whole project before reporting it with a severity and a suggested fix. V0 only changes code if the user agrees, and the feature is available on paid plans.

Key Takeaways

  • Security Review lets users ask V0 to audit their code for vulnerabilities with a plain request: "Run a security review."
  • It targets common web flaws, including missing auth checks, injection, and SSRF.
  • V0 reviews the code changed in the chat, or the riskiest code in the project when nothing changed.
  • Every finding is verified against the whole project before it is reported, which reduces false positives.
  • Each finding includes a severity rating and a suggested fix.
  • Reviews use V0 credits, run on the selected model, and need a paid plan. V0 changes code only with the user's consent.

Ask V0 to Review Your Code for Security Issues

V0 added Security Review, a way to have the assistant audit generated code for vulnerabilities. Users can look for problems such as missing authentication checks, injection flaws, and server-side request forgery (SSRF).

How the Review Works

V0 reviews the code the current chat changed. If nothing has changed, it instead looks at the riskiest code in the project. It reads related files to understand context, and it checks every finding against the user's whole project before reporting it. This verification step is meant to cut down on false alarms.

Each reported finding comes with a severity and a suggested fix. V0 only modifies code if the user agrees, so the review never alters a project unprompted.

Getting Started and Availability

Starting a review is as simple as asking: "Run a security review." Reviews run on the user's selected model and use V0 credits. Security Review is available on paid plans. V0 also documents the feature in its docs.