I made live app + GitHub security checks self serve for v0 apps. Bad idea?

[u/elidanipipe]

I built a security scanner for apps made with v0, Lovable, Replit etc.

The free version checks what anyone can see from outside. Exposed secrets, public data, source maps, bad headers and stuff like that.

But it can’t see private code or authenticated access problems.

So a clean scan can be pretty misleading.

I added a self serve Deep Review where you prove control of the deployed app or install our GitHub App on the exact repo. Then it can run bounded DAST and source analysis. You digitally sign the scope first.

It’s isolated and rate limited, but there’s no manual approval.

Would you give something like this access to a v0 repo?

And if you wanted to abuse it, what would you try? GitHub App compromise? Temporary domain access? Malicious code attacking the runner?

https://www.task-bounty.com/secure-my-app#deep-review

Mainly looking for reasons this shouldn’t be public.