Harden a v0 MVP before paid traffic (2026)

Stay on the v0 export. Close doors first.

The canvas is paid to ship tonight. Paid traffic is paid to send strangers at the production host. Those jobs collide. A green Publish badge can still leave a live key in the thread, a Development-only var, or a shareable chat as the public origin.

v0’s own docs draw the line. The FAQ (updated March 2026) is plain: the canvas is a chat plus a Project plus a Vercel project. Previews now run the full Next.js app — server routes, databases, environment variables — inside a Vercel Sandbox. That is closer to production than a browser mock. It is still a lab. Deployments split the two ships. A working-branch preview gets its own URL and does not change production. Publish updates the Vercel project’s stable production URL.

Vercel Integration adds the quiet part. v0 accounts are Vercel accounts. The first Publish creates a Vercel project if one is missing. GitHub-backed Publish merges the chat’s pull request into the base branch, then waits for the production build. You do not need a new host this week. You do need to name who owns that Vercel project, who can Publish, and which URL ads will hit.

Fix the biggest risk first

Start with the worst risk, not a prettier canvas. A stranger who opens the shareable chat, dumps a NEXT_PUBLIC_ secret, or hits a Sandbox-only login will cost more than a restyle. Put those risks in order, worst first. Close the worst one tonight.

Put six names on paper: who owns the transcript, who proves login on the advertised host, who can name server vs client files, who tests the ID swap, who owns the public origin, and who can Instant Rollback tonight. Two red names plus a campaign date means spend stays off. If you cannot name a human for each layer, book.

Secrets: the chat transcript is not a vault

Keys are the first thing ads will leak. v0’s Projects page is the split. Environment variables are encrypted on the connected Vercel project so you do not have to paste them into prompts. External APIs is sharper. Add keys under Project menu → Settings → Environment Variables. The v0 preview only reads variables targeted at Development. Production and Preview are different stores.

Vercel Integration is blunt about the gap: the preview window cannot see sensitive variables. That is good hygiene inside the canvas. It is also why a preview can pass and the production URL can fail — or the reverse, if a live key only exists in Development. Vercel environment variables add the last leak. Values are visible to anyone with project access. A change does not rewrite old deployments. You must ship a new one.

v0 generates Next.js. Next.js environment variables are blunt: a name prefixed with NEXT_PUBLIC_ is inlined into the JavaScript the browser downloads. Treat every NEXT_PUBLIC_ value as public. A service-role key, Stripe secret, or OpenAI key in that prefix is a leak. CodeCross’s conservative policy is to rotate a live key pasted into a thread, even when no public disclosure has been demonstrated. Rotate it at the issuer. Store the new value on the Vercel project, not in chat history.

Sharing is the second drawer. Anyone with the link can open the chat. It is not indexed. Anyone on the web can be. A Team Owner can still open a “private” team chat by URL. Default team visibility is often “everyone can edit.” The pass is simple. A viewer of the public app cannot open the v0 editor. Customers get the production URL. The editable chat stays with people you named. If the campaign still lists a shareable v0 URL, you are not ready for ads.

Login must work on the production Vercel host

A demo login is any path that signs a stranger in only inside the v0 canvas or a working-branch preview. The FAQ says the new preview runs server-side features. That is the start. It is not the wrap. Sandbox success is not production-host proof. Site URL and redirect lists must include the hostname ads will hit. Google or GitHub OAuth you own also needs that callback in the provider console. An account you made in the canvas may not exist on Production.

Deployment Protection is a different door. Vercel Authentication, a password, or Standard Protection can hide a preview from the public web. That is a Vercel gate. It is not your app’s login. A founder who “signs in” with their Vercel account has not proved customer auth. If Standard Protection is on, NEXT_PUBLIC_VERCEL_URL is not a public fetch target. Use the host the user typed.

Run these four checks on the advertised Vercel host. The Sandbox does not count:

1. The advertised Vercel host signs a stranger in. A canvas or working-branch session is not that proof.
2. Logout and expiry work after a hard-refresh. A cookie that never dies on a shared laptop is a gift.
3. Admin is a server check, not a role the chat mixed into a client component.
4. OAuth, magic links, and reset mail land on the production host. A shareable v0 URL or leftover .vercel.app is a lab callback.

A custom name that still bounces to a shareable chat, a working-branch preview, or a leftover .vercel.app is a lab callback with DNS. Fix the Site URL and OAuth allowlist on this Vercel project. Do not open get-off v0 just to dodge a redirect list.

Client vs server: canvas is not Next.js

This is the v0-only layer Softgen, Lovable, Replit, and Bolt do not share. v0 generates Next.js — React, TypeScript, Tailwind, shadcn/ui. The FAQ says the Sandbox preview is closer to production than the old browser mock. Closer is not equal. A client component that only ran in the generator can fail on SSR, hydration, or the edge runtime. A server action that read Development env can 500 on Production. A fetch that used window in a server file will not wait for your ad click to break.

Walk the money path on the production deploy, not only in the chat. Hard-refresh. Open a private window. Hit the same route twice. If the first paint is empty, if the form double-submits, or if an API route returns HTML, that is a Next boundary, not a copy tweak. Hide nothing behind typeof window !== "undefined" and call it done. Server checks stay on the server. Public names stay public. If you cannot name which files are server and which are client, book.

Rows and files: hidden buttons are not rules

Row checks are the wrap ads will test. v0 can wire Supabase, Neon, or another integration from the Project. That is speed. It is not a policy. If the backend is Postgres with row rules, Row Level Security is the matching fact. Those rules decide who may read each row. A table in an exposed schema without RLS is readable and writable by any role with a grant on it. A service-role key bypasses RLS, so keep it on the server — never in a NEXT_PUBLIC_ name or a v0 prompt.

Change an ID on the production URL. Confirm you cannot open another account’s row or file. Filtering on the screen is not the wrap. A hidden generated button is not the wrap. Frontend auth state is only for UI. The server must check the session. If you cannot explain who can read a row after the wrap, stop calling it hardening. That is a rewrite trigger with a friendlier name. Open migrate from v0 when that is the honest page.

Shareable v0 URLs and vercel.app can leak

v0 gives you three addresses that look live. They are not the same job.

Custom domains say every deploy already has a vercel.app URL. You can pick another .vercel.app name or add your own. DNS lives in Vercel. The lab names still exist. Deployments add the trap: the first Publish asks who can access the deployed app. Visibility is a Vercel setting. It is not a sitemap. Stay-harden is fine if ads, mail, sitemap, and login links print the name you mean to keep. It is not fine if the campaign still lists a v0 share, a branch preview, or a leftover Vercel subdomain.

Projects is the team trap. Multiple chats can share one Project. Deploying from any of them updates the same production URL. Name the chat that is allowed to Publish. Hide the rest. Search the tree for v0.app, vercel.app, and old callback URLs. Check OAuth allowlists, webhooks, CORS, and password-reset mail. If Auth still allows a preview host as a success URL, strangers will bookmark the lab.

Off switch: Instant Rollback, not regenerate

A bad preview deploy needs an off switch you can name tonight. Deployments point you at the Vercel inspector for rollbacks and redeployments. Instant Rollback is that switch. It points production domains at a prior production deploy without a rebuild. Hobby can roll back to the last production deploy. Pro and Enterprise can pick any eligible one. Preview-only deploys are not eligible. After a rollback, Vercel turns off auto-assignment of production domains until you undo it.

“Fix with v0” and “ask v0 to revert the chat, then Publish again” are repair paths. They are not an off switch. They wait on a prompt, a build, and — on a GitHub-backed project — a merge. Ads will not wait. Write the rollback owner on paper. Prove you can hit Instant Rollback from the Vercel project, not from a chat you might lose. A feature flag or a kill switch on a paid-API route is extra. It does not replace a prior production deploy you can restore in seconds.

Restore: a chat version is not a drill

v0 can restore an earlier chat version. That is code. It is not rows. Instant Rollback is also code. Integrations such as Neon, Supabase, Upstash, and Stripe keep their own stores. If you cancel the chat, you have not exported the database. If you Instant Rollback, you have not un-deleted a row a stranger wrote. You need both a deploy you can restore and a data copy you have actually opened.

Two ad-driven tabs will hit the same seat, coupon, or invite. Instant Rollback will not un-double-book a row. A chat version will not either. Prove the primary write once, with two tabs, on the production URL. Open a data copy you could restore without the chat. A drill you have not run is a wish.

Score each row against the production host, not the canvas. One red cell — transcript keys, canvas-only login, SSR miss, shareable v0 URL, or an Instant Rollback you have never hit — is enough to hold the spend. Move that cell. Do not greenwash the matrix.

The pre-ads week

Treat the next seven days as operator time on the Vercel project, not a slogan. Inventory the chat that can Publish, the Production env store, and who can Instant Rollback. Then seal. Then prove. Leave the canvas-exit pages closed until that list is honest.

Day 0 is inventory. Write five facts. The public URL. The Vercel project name. The chat that is allowed to Publish. The person who can Instant Rollback tonight. Whether a stranger can open the editor. If the public origin is already taking payments and you cannot name those five, stop. You do not need a new screen. You need this list.

Seal transcript and env first. Then prove the host. Then rows. Rate-limit signup on the same day you move keys out of chat — bots do not wait for DNS. If payments exist, check webhook signatures against Production env, not Development. Then strip shareable v0 URLs. Then hit Instant Rollback and open a data copy. Then spend. The v0 MVP hardening clipboard is the short list. This page is the week you run it.

Treat those bars as calendar you reserve, not a vendor promise. If you cannot name the production host, which chat can Publish, and who can Instant Rollback, the later days will thrash. These ranges are an example only, not a quote or a promise.

Stay-harden vs leave. Do not mix the seats.

Pick one seat for this week. Stay-harden keeps the chat as the ship path on the same Vercel project, with Production env, canvas-vs-host login, and Instant Rollback already proved. Leave opens get-off v0 and stops buying clicks that need that Publish tab. Running both seats at once is how teams rewrite screens they already had.

If you only need a leave date, use when to leave an AI builder. A door that will not close on this Vercel project belongs on rewrite vs harden. A personal Git remote belongs on GitHub handoff. A Publish-only ship path belongs on CI/CD after an AI builder. Rows already in your own Supabase belong on Supabase hardening. Other builders have their own pages on the vibe coding hub.

A v0 working branch is not company ownership

GitHub is useful this week. It is not the wrap. v0 never pushes directly to main. A chat gets a working branch. Publish creates or reuses a pull request, merges it, and waits for production. Required checks and reviews still apply. If protection blocks the merge, the pull request stays open. That is Git working. It is not proof a stranger cannot open the chat.

GitHub sync moves code. It does not grant Vercel deploy rights. A Vercel Viewer can Publish from v0 with the v0 Builder role and still fail to deploy from GitHub. Pick the company org under Git Scope when you create the private repo. If you imported a repo, v0 did not give you a second writable copy. Secrets do not travel in the prompt. Rows do not travel in the branch. Do not treat that connection as the GitHub handoff. This week you only ask: can a stranger open the chat, and do you know which branch production actually builds?

When the list turns red

Leave the product up. Kill the campaign if any of these are still true:

• A live key still exists only in a v0 thread, a committed NEXT_PUBLIC_ secret, or a chat set to Anyone with the link.
• Login still works only in the canvas or a working-branch preview, or a callback still lands on a share URL or a raw .vercel.app.
• A client/server boundary that only passed in the Sandbox fails on a hard-refresh of the production URL.
• A hidden generated button is the only “permission,” or a storage bucket is public.
• Ads, mail, or the sitemap still list a v0 share or a preview deploy.
• The off switch is “we will regenerate in v0,” or you have never opened a data copy.
• Two people disagree about which chat can Publish or who can Instant Rollback.

A single red door is a miss, even if Publish is green. Stop asking the chat for new screens until Production env, canvas login, and Instant Rollback are honest. Finish that wrap. Then spend — or open get-off v0 if the chat is still the company.

Bring a second pair of hands when the founder cannot rotate a key without pasting it back into the thread, when canvas login still fails on the advertised host and the campaign is close, or when nobody has hit Instant Rollback before the date. Hire for Production env, SSR/hydration edges, row checks, and the URL map — not for a prettier canvas. Austin app development company is the company brief. Austin mobile app development if the next door is a store binary that still points at this v0 URL.

Next steps

Walk the gates in order. Inventory the public URL, the Vercel project, the chat that can Publish, and who can Instant Rollback. Seal env and hide the editable chat. Rate-limit signup and reset. Prove login on the advertised host. Hard-refresh the money path. Test rows and files with an ID swap. Strip v0 share links, working-branch previews, and leftover .vercel.app names from ads, mail, sitemap, and callbacks. Run rollback and a data copy. Then buy the click — or open the exit if the process itself must leave the canvas. Pause any prompt that only ships from v0 while a gate is red.

CodeCross LLC is a Delaware-registered company with an Austin postal address. Product and engineering are in Pakistan. The v0 week we run is transcript keys, canvas-versus-production-host login, SSR/hydration on the money path, row checks, shareable-URL cleanup, then Instant Rollback. The Austin app development company page is the company brief. Austin mobile app development is the store-binary engagement if the next door is a signed build that still points at this v0 URL. Our apps are on the App Store and Google Play. When Instant Rollback, Production env, or the advertised host is still red and the campaign is close, book a conversation.

v0 is allowed to stay the process. Ads are not allowed to treat a Sandbox pass, a shareable chat, or a Publish badge as that proof. Show Instant Rollback on a prior production deploy, a session on the advertised host, and keys that never lived in the transcript. Most teams never need a second codebase once those three exist.

Next steps: take v0 to production, or plan a move away from v0.

FAQ

When Publish succeeds, did Production env actually receive the vars the Sandbox never saw?

Not by default. External APIs and Projects split Development, Preview, and Production. The canvas preview only reads Development. Vercel Integration is blunt: the preview window cannot see sensitive variables. Deployments say Publish updates the stable production URL — that is a ship, not a copy of Development env onto Production. Prove the money path on the advertised host with Production-targeted vars. A Sandbox pass is a lab.

Does connecting GitHub finish the wrap?

No. GitHub keeps code on a working branch and publishes through a pull request. v0 never pushes to main. Sync does not move rows or secrets. A Vercel Viewer may still Publish from v0 and fail to deploy from GitHub. That proof lives on GitHub handoff. This page only asks: did the branch move keys or hide the chat? It did not.

If the canvas signs a stranger in, does that session exist on the advertised Vercel host?

No. The FAQ says the Sandbox preview now runs server routes and databases. That is closer to production than a browser mock. It is still not the advertised host. Site URL, redirect lists, and OAuth callbacks must include the hostname ads will hit. An account you made in the canvas may not exist on Vercel Production. Deployment Protection is a Vercel gate, not customer auth. Prove sign-in, logout, and admin split on the production URL.

Can I paste keys into a v0 thread or a NEXT_PUBLIC_ name and buy ads?

No. Projects and External APIs put keys on the Vercel project, split by Development, Preview, and Production. The preview only sees Development. Next.js inlines every NEXT_PUBLIC_ value into the browser bundle. A service-role or Stripe secret in that public prefix is exposed. For chat or repository copies, check who could access them; rotate under our conservative policy and remove the unintended copies. If a viewer of the app can open the v0 editor, sharing is still red. Do not buy ads on a red drawer.

Can the production host be live while ads still print a shareable v0 URL?

Yes — and that is a fail. Sharing says Anyone with the link can open the chat. Custom domains and Deployments leave the vercel.app name and the shareable chat in place after you add a domain. Stay-harden is fine if ads, mail, sitemap, and login links print the name you mean to keep. It is not fine if the campaign still lists a v0 share or a working-branch preview. Leaving the canvas as the ship path is the get-off job, not this page.

Does Instant Rollback count if you have only regenerated the chat?

No. Instant Rollback points production domains at a prior production deploy without a rebuild. Preview-only deploys are not eligible. “Ask v0 to revert the chat, then Publish again” waits on a prompt, a build, and — on GitHub — a merge. Ads will not wait. Name the rollback owner. Hit Instant Rollback from the Vercel project. A chat version is code, not rows — still open a data copy you could restore without the thread.