v0: vibe coding, securely
By Steven Van ·
v0 has blocked over 100,000 insecure deployments since launch, including 17,000+ in July, mostly for exposed API keys.
Vercel says its v0 app builder now screens AI-generated code for common security mistakes before deployment, instead of leaving them for developers to find later. The company points to a recent incident in which a viral app leaked 72,000 selfies and government IDs through a misconfigured, publicly accessible Firebase bucket as the kind of default-setting error it is trying to catch.
During generation, v0 checks for:
- Secrets exposed in client-side code, including credentials placed in Next.js's public NEXT_PUBLIC_ variables
- Tokens or session data written to logs
- Prompt injection risks from unsanitized user input
- Misconfigured third-party API integrations
- Unsafe defaults for authentication, routing, and database access
Vercel says v0 has blocked more than 100,000 insecure deployments since launch, including over 17,000 in July alone, most involving exposed API keys, NEXT_PUBLIC_ variable misuse, and unauthenticated API routes. Apps built with v0 also get Vercel's platform-level protections: preview links that stay private unless shared, deploy blocks that flag vulnerabilities for review before release, role-based access control, audit logging of deploys and environment changes, and a Vercel AI Gateway that routes model calls with server-side, short-lived credentials rather than exposing provider keys. Read the full announcement for Vercel's breakdown of the mistakes it says AI tools make most often.
