---
title: v0 Security Check
description: "Ask v0 to review your chat's changes, or your whole project, for security issues, with each finding checked against the whole project."
docs_index: /docs/llms.txt
lastUpdated: 2026-11-12
product: v0
type: guide
prerequisites:
  - /docs/sandbox
related:
  - /docs/security
  - /docs/code-editing
  - /docs/model-picker
  - /docs/api/v2/guides/security-review
---

> For an index of all documentation, see [/docs/llms.txt](/docs/llms.txt).

A **v0 Security Check** checks the code your chat changed, or your whole project when nothing changed, for security issues such as missing authentication or authorization checks, injection, server-side request forgery (SSRF), and unsafe handling of user input. v0 then checks every finding against your whole project before reporting it.

## Run a review

Ask v0 in the chat, for example: "Run a security check." v0 only runs a review when you ask for one.

While the review runs, its card shows the spots it found to check, its progress, and the file it's reading. When it finishes, the card shows the result, such as "v0 Security Check: 2 potential issues", with the findings by severity and the files it reviewed. v0 then checks each finding against your whole project and lists the confirmed ones in its reply, with their severity, file and line, and a suggested fix, followed by the ones it dismissed and why.

## What gets reviewed

- **Your changes**: the files changed on the chat's branch compared with its base branch, plus uncommitted changes. If more than 50 files changed, v0 reviews the riskiest ones and tells you which it skipped.
- **Your whole project, when no application code changed or when you choose it**: for example, right after you import a repository. v0 reviews up to 50 of the riskiest files, such as route handlers, server actions, middleware, auth, and database access, and lists them. In a larger project, it covers the riskiest files, not every file.
- **Related files for context**: v0 also picks up to 50 other files the reviewed code depends on, such as auth helpers, middleware, and data access code. They're read for context, not reviewed.
- **Skipped files**: docs, assets, lockfiles, generated files, environment files, credentials, and keys.

If your chat has changes and you ask for a review of the whole project, v0 asks which one you mean.

## How findings are checked

The review only sees the files v0 picked, so v0 checks each finding against your whole project before reporting it. If other code already handles an issue, for example middleware that enforces the authentication a route seems to lack, v0 dismisses or downgrades the finding and tells you why. Each remaining finding comes with its severity, the file, and a suggested fix.

v0 doesn't change your code during a review. It offers to fix the findings, and only makes changes if you agree.

## Models and cost

A review runs on the model selected for the chat and always uses v0 credits, even when your ChatGPT plan pays for your chat messages. Reviews appear as **v0 Security Check** in your usage.

## Availability

v0 Security Checks are available:

- On paid v0 plans
- In VM-backed chats (see [Sandbox](/docs/sandbox))
- With models that run through v0, including v0 models and AI Gateway models. Agent harness models aren't supported.

Some enterprise deployments aren't eligible.

## Privacy and isolation

- The review works on a read-only copy of the files it reviews and reads for context, outside your project.
- Your project's code isn't run during the review.
- Model requests use zero data retention.
- A review stops after 15 minutes.

## v0 API

v0 Security Checks also work through the [v0 API v2](/docs/api/v2/guides/security-review): ask for a review in a message, then read the review's status from a structured message part and the checked findings from v0's final message.

---

For a semantic overview of all documentation, see [/docs/sitemap.md](/docs/sitemap.md)

For an index of all available documentation, see [/docs/llms.txt](/docs/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/docs/agents.md](/docs/agents.md)