v0 App Security Check

Q: Do I set headers in vercel.json or next.config?

Either works. For a Next.js app built in v0, next.config keeps everything in one place where v0 can see it. Just don't set the same header in both, so there's no conflict.

v0 by Vercel turns a prompt into a working Next.js app and publishes it to Vercel in a few clicks. That foundation is solid. Vercel issues HTTPS certificates automatically, and Next.js keeps environment variables server-side unless you deliberately expose them. The gaps in v0 apps are usually the things nobody asked for: security headers, a public variable that should have been private, and a launch page Google can't index.

The Pro Logica AI App Security Check is a free, passive scan of your live v0 app. You get a score out of 100 and a ranked list of findings in about a minute. Run a free v0 app security check.

What we check on v0 apps

Security headers. Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, clickjacking protection (X-Frame-Options or CSP frame-ancestors), Referrer-Policy and Permissions-Policy.
TLS. Whether the certificate is valid and when it expires. On Vercel this is usually fine. It's worth confirming on a custom domain with unusual DNS.
Client-side secrets. v0's own docs explain the rule: variables without the NEXT_PUBLIC_ prefix stay on the server, and variables with it are exposed to the browser. We scan your homepage and up to eight of your own JS files for live key patterns, and mask anything we find.
Database exposure. If your app uses Supabase or Firebase from the browser, we test whether anonymous visitors can read data. These are count-only and shallow requests, and no records are downloaded.
Public files and source maps, such as /.env, /.git and .js.map, checked once each when you confirm ownership.
Indexability. noindex, title, meta description and sitemap.

Headers on Vercel: where to set them

There are two common ways to set response headers for a v0 app.

1. next.config.js (or .ts) headers(). This keeps headers with the code that v0 edits:

async headers() {
  return [{
    source: "/(.*)",
    headers: [
      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains" },
      { key: "X-Content-Type-Options", value: "nosniff" },
      { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
      { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
      { key: "Content-Security-Policy", value: "frame-ancestors 'self'" },
    ],
  }];
}

2. vercel.json headers. This uses the same source and headers shape and works for any framework on Vercel.

About CSP. The snippet above starts with frame-ancestors 'self', which blocks clickjacking right away. A full script policy for Next.js usually needs a per-request nonce, because the framework injects inline scripts. Next.js documents a nonce-based CSP pattern for this. Roll it out with Content-Security-Policy-Report-Only first, watch the browser console for blocked sources, then enforce. Don't use script-src * or 'unsafe-eval' to make errors go away.

How often is CSP missing? In our passive check of 18 public showcase apps built with Lovable or Bolt, 18 of 18 had no Content-Security-Policy and 18 of 18 had no clickjacking protection. The average score was 76 out of 100. We didn't sample v0 apps, but no builder adds a CSP unless someone asks for one. See the missing security headers checklist.

Can Google index your launch page?

A v0 app can look perfect and still be invisible in search. Watch for these:

noindex on the page you share. Make sure the page doesn't send noindex in a meta tag or an X-Robots-Tag header. Share your production domain, not a preview URL, and confirm the production deployment is public in your Deployment Protection settings.
A real title and description. Use the Next.js metadata export (or generateMetadata) on every page that matters. Write a unique title and a meta description that describes the page for a human.
A sitemap. Next.js supports app/sitemap.ts and app/robots.ts metadata files. Generate /sitemap.xml, list it in robots.txt, and submit it in Google Search Console.

In our 18-app sample, 15 of 18 had no sitemap we could find, 6 of 18 had no meta description, and 3 of 18 had no <title>.

Fix it with v0

When you unlock the full report, every finding comes with masked evidence, a plain-English fix, and a copy-paste prompt written for v0. For example, the headers prompt asks v0 to add the headers() block to next.config, set up a nonce-based CSP in report-only mode, and tell you how to verify it with curl -I after you publish. You review the change in v0 and publish again.

Missing security headers checklist
Exposed API key in frontend
Other builders: Lovable · Bolt.new · Replit · Cursor
Next step: Run the free check on your app · all Pro Logica cybersecurity services

FAQ

Isn't Vercel already secure?

Vercel handles TLS and runs server code in isolated functions. Response headers like CSP, and what your app chooses to expose, are still up to you. We check the live result.

Are `NEXT_PUBLIC_` variables a security problem?

Only when they hold secrets. They're copied into the browser bundle at build time, so they're fine for public IDs and publishable keys and never okay for secret keys.

Do I set headers in `vercel.json` or `next.config`?

Either works. For a Next.js app built in v0, next.config keeps everything in one place where v0 can see it. Just don't set the same header in both, so there's no conflict.

Can the scan see my v0 chat or code?

No. It only fetches what your public URL serves, the same as any browser.

How long does it take?

About a minute. You'll see your score and severity counts as soon as it finishes.

Make sure your launch page is secure and indexable. Run the free v0 app security check.

By Pro Logica