v0 security checklist
v0 generates Next.js apps that deploy to Vercel. Next.js runs code in two places, the browser and the server, and the line between them is where most mistakes happen: a setting starting with NEXT_PUBLIC_ is public, and a server action is a public endpoint.
Check these before real users and real payments arrive.
Secrets behind NEXT_PUBLIC_
NEXT_PUBLIC_ copies the value into the browser code.
Routes and server actions without an owner check
Anyone can call them directly, with any id.
Sign-in checks only in a redirect
A redirect is not protection if the page or data can still be reached.
Payments processed twice
Payment providers retry webhooks, so each event must be handled once.
Prices from the browser
The server decides the price; the page only names the plan.
Functions that hit their time limit
Serverless functions stop at a fixed time; long jobs need another shape.
A bill that grows while nobody is using the app
Bots and loops cost money even on quiet weeks.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.