Short answer
To test a v0 app, check that no secret uses a NEXT_PUBLIC_ variable, set environment variables for Production as well as Development, and test the deployed app in a browser. Vercel protects preview deployments with a login by default, so TestOptim AI tests the production URL, or a preview you have made reachable, signed in with a test account.
- v0 apps are Next.js apps deployed to Vercel, with a preview deployment for each working branch.
- Vercel Authentication protects previews by default; an outside tester sees Vercel's login page instead of your app.
- The in-chat preview reads only Development variables, so it can work while Production is broken.
On this page
How a v0 app is built and hosted
v0, from Vercel, builds full-stack apps that default to Next.js with shadcn-style components. In 2026 v0 started scaffolding new apps that need a database and sign-in with Neon, Drizzle and Better Auth; Supabase and other databases come through the Vercel Marketplace.
Each change goes to a working branch with its own preview deployment at a unique vercel.app URL, and publishing promotes it to production on a stable vercel.app address or your domain. Vercel turns on Deployment Protection for new projects, so previews need a Vercel login with access to the project, while the production domain stays public.
What v0 already tests in your app
- Browser use: ask v0 to open the app and test a flow, and it reports back with screenshots.
- Terminal: v0 can run unit tests in its sandbox.
- Error fixing: v0 fixes failed builds automatically, and Fix with v0 handles CI failures.
- Secret warnings: v0 checks
NEXT_PUBLIC_variables and warns when a secret would be sent to the browser.
These run when you ask, inside v0's sandbox. TestOptim adds repeatable, signed-in tests of the deployed app with negative and edge cases, on every deploy or on a schedule.
Bugs to check in a v0 app
- Secrets exposed to the browser. Any variable starting with
NEXT_PUBLIC_is built into the page. Keep API keys in server-only variables. - Production missing environment variables. The in-chat preview reads only Development variables, so a variable never set for Production breaks the deployed app while the preview looks fine. TestOptim records the failed requests and 5xx responses this causes.
- Sign-in that loops back to the login page after deploying, usually because of cookie, domain or redirect URL differences between the preview and production domains.
- API calls that return 401 on protected previews, because Vercel's protection cookie is scoped to one host.
How to test a v0 app with TestOptim AI
- Choose the URL. The production domain is public. For a preview, change its Deployment Protection settings in Vercel so it opens without a Vercel login. Open the URL in a private browser window. If you see your app without signing in to the builder, TestOptim can reach it too.
- Create a test account with email and password in the deployed app.
- Create a TestOptim project with the URL and add the account as a credential profile.
- Explore, generate and run, then paste each issue's steps into v0 to fix it and mark the issue fixed to re-run its test.
- Test every deploy. Have your pipeline start a run with an API key after each deploy. v0 works through Git branches, so TestOptim can also re-explore on push to keep its map current.
Whether a v0 preview and production share a database depends on how you set up the database integration. Check before testing a preview against data that matters.
Frequently asked questions
Why does my v0 preview show a Vercel login page to testers?
Vercel turns on Deployment Protection for new projects, so preview deployments need a Vercel login with access to the project. Test the public production domain, or change the preview's protection settings in Vercel so an outside tester can open it.
Why does my v0 app work in the chat preview but not when deployed?
The in-chat preview reads only Development environment variables. If a variable was never set for Production, the deployed app gets an undefined value and calls fail. Add the variable for Production in Vercel and redeploy.
How do I stop my v0 app leaking API keys?
Never put a secret in a variable that starts with NEXT_PUBLIC_, because Next.js builds those into the page sent to every visitor. Keep keys in server-only variables and call the third-party API from a server action or API route. v0 warns when it spots one.
Does v0 test my app?
On request. You can ask v0 to open the app and test a flow, and it can run unit tests in its sandbox and fix failed builds. It does not run signed-in browser tests of your deployed app on every deploy; that needs a separate tool or your own test suite.
Can TestOptim run on every v0 deploy?
Yes. Start a test run from your pipeline with an API key after each deploy and fail it on critical or high issues. Because v0 changes go through Git, connecting the repository also lets TestOptim re-explore on push, which updates its map but runs no tests.
Which database does a v0 app use?
Since 2026, new v0 apps that need a database and sign-in are scaffolded with Neon, Drizzle and Better Auth by default. Older apps and many community examples use Supabase. Check your project's Vercel integrations to see which one yours uses before testing data flows.
Sources
Platform facts were checked against these pages on 22 October 2026. Builders change quickly, so check them again before relying on a detail.
More Vibe-coded apps guides
- How to test a vibe-coded app before you launchHow to test a vibe-coded app from Lovable, Bolt, Replit, Base44 or v0: the bugs AI app builders leave, what their own checks miss, and a launch checklist.
- How to test a Lovable app before you launchHow to test a Lovable app: what Lovable's security scan and browser testing cover, the Supabase RLS and sign-in bugs to check, and how to QA lovable.app.
- How to test a Bolt.new app before you launchHow to test a Bolt.new app: the localhost redirect, open database policies and missing env vars to check, and how to QA bolt.host.
- How to test a Replit app before you publishHow to test a Replit app: secrets and databases that differ in production, Replit Auth sign-in, what Replit App Testing covers, and how to QA replit.app.
- How to test a Base44 app before you launchHow to test a Base44 app: what the Testing Agent and Security Scan cover, why sign-in can only be tested once published, and how to QA base44.app.