v0-generated apps are typically Next.js and React, which means they inherit the exact security defaults (or lack of them) that any hand-written Next.js app would have — no security headers unless you add them, and any secret referenced from client code ships to the browser. Because v0 is often used to scaffold a UI that's then wired to a real backend afterward, the biggest risk is usually in what gets connected after generation, not the generated code itself.
v0 generates polished, production-grade-looking React and Next.js components from a prompt. The visual and code quality being high doesn't imply the security configuration is — headers, secret handling, and backend access rules are a separate concern from component code.
Common issues in v0 apps
Missing security headers
A v0-generated Next.js app has no Content-Security-Policy, HSTS, or X-Frame-Options set unless you add them in next.config.js or middleware — v0 generates components, not deployment hardening.
API keys wired in during the "connect a backend" step
Once a generated UI is wired to a real API or database, it's common to paste a key into a client component to "get it working," especially inside a client-marked component that v0 scaffolded for interactivity.
Exposed source maps
Default Next.js production builds emit source maps unless productionBrowserSourceMaps is explicitly set to false, handing out original, unminified source to anyone who requests the .map file.