v0 produces good-looking Next.js apps and puts them on Vercel in one click. Vercel's defaults are solid, which makes the remaining gaps easy to miss: they're the ones a platform can't decide for you.
v0 generates Next.js with the App Router, Tailwind and shadcn/ui, deployed to Vercel, often with a Vercel-integrated database such as Supabase, Neon or Upstash.
What v0 gets right
- HTTPS, automatic redirects from http, and HSTS come from Vercel.
- Server components and route handlers keep secrets on the server, as long as the code uses them that way.
- Environment variables are managed per environment, and only NEXT_PUBLIC_ ones reach the browser.
What v0 apps usually ship without
- No rules about which scripts can run on your siteVercel doesn't send a Content-Security-Policy for you. It goes in next.config headers, and generated apps don't include it.
- Clickjacking possible: others can embed your siteClickjacking protection is also yours to add.
- A secret key is baked into your JavaScript filesA key given a NEXT_PUBLIC_ prefix, or used inside a 'use client' component, is published.
- Missing privacy policyGenerated apps have a beautiful footer and nothing legal in it.
- Trackers fire before visitors agree to anythingGoogle Analytics or a pixel added to the root layout loads for every visitor before consent.
- Embeds share visitor data without askingGoogle Fonts via a link tag, YouTube and map embeds all contact other companies on load. next/font self-hosts fonts for you.
- Nowhere for good hackers to report a problemNo way for someone who finds a hole to tell you.
vibeliq checks all of these, and 31 more, from the outside: see every check.
What to review by hand
An outside scan, ours included, reads what a visitor’s browser receives. These live inside your accounts, so they need your eyes:
- In Vercel, open Settings, then Environment Variables, and read every name starting with NEXT_PUBLIC_. Those are public. Secrets must not have that prefix.
- Mark real secrets as Sensitive in Vercel so they can't be read back from the dashboard.
- Open each route handler and server action and confirm it checks the signed-in user before touching data.
- If the app talks to Supabase from the browser, check row-level security in the Supabase dashboard. It can't be seen from outside.
Questions people ask
Doesn't Vercel handle security for me?
It handles the transport: HTTPS, redirects, HSTS, DDoS protection. It doesn't know which scripts your app should be allowed to run, what your privacy policy says, or whether your analytics waits for consent. Those are yours.
Is NEXT_PUBLIC_ safe?
It's safe for values that are meant to be public. It's how secret keys most often leak in Next.js apps, because adding the prefix is the quickest way to make an undefined variable work in the browser.
How long does a scan take?
About a minute. We open your site in a real browser, visit up to nine pages, and read your JavaScript files.