Skip to main content

v0 · Preview is not production

Harden the v0 export: preview is not a production Vercel project

A v0 canvas can emit a convincing Next app into a Vercel preview in minutes. Hardening starts after export: name who owns each generated component, strip secrets the canvas left in the client, and force a hard line between disposable preview deployments and the production Vercel project that will take real users. You keep the generated UI; you stop treating the canvas or a preview URL as “live.”

30 min · senior team · leave with a clear next step

Company-level evidence

Review methodology

Citation-ready answer

Answer you can cite

CodeCross LLC defines v0-mvp-hardening as making an exported Vercel v0 React/Next tree safe for real sessions: component ownership outside the canvas, no secrets in client bundles or chat/export artifacts, and explicit Vercel preview vs production project gates. Intent is traffic readiness without regenerating the UI. The ship gate before campaigns is: production env and domain attached only to the production project, with auth and payment webhooks verified against that project—not against a canvas-spawned preview.

What a v0 preview still hides

A canvas-spawned preview is not a production Vercel project

Hardening starts after export. Name who owns each generated component, strip secrets the canvas left in the client, and refuse to treat a preview URL as live.

  • Generated routes have no named maintainer

    Orphan files that exist only in the last canvas generation are a snapshot. If nobody can point to the PR that last changed checkout or settings, you do not have ownership.

  • Demo patterns leak secrets into the client

    `NEXT_PUBLIC_*` vars pasted from canvas chat, API keys embedded “to make the demo work,” and service-role keys mirrored into browser calls the export scaffolded for speed.

  • The preview URL is treated as a soft launch

    PR previews share production secrets or paying-customer DNS. A preview host is a review artifact; only the production project receives production env.

  • A custom domain attaches before production gates pass

    Auth callbacks, webhook signatures, error-tagged releases, and a rollback that does not regenerate UI in the canvas all have to be true first.

The export harden we actually run

Owners, client-bundle hunt, then preview vs production

Keep the generated UI. Do not regenerate it. Production env and domain attach only to the production Vercel project.

01

Import every export path under a named owner

Every route and shared primitive lives in the org repo and changes only through review. Orphan canvas-only files are imported or deleted.

02

Hunt the client bundle and git history for canvas leaks

Rotate anything that ever appeared in a v0 prompt or public preview before the production project sees real sessions.

03

Separate Vercel projects (or env + domain) from PR previews

Disable indexing on preview hosts. Distinct OAuth allowlists. Never point paying-customer DNS at a preview deployment.

04

Attach the custom domain last

Clean CI checkout without an open v0 session, callbacks on the custom domain, webhooks on the production project, and a previous-deployment restore.

How to

Harden an exported v0 app before a custom domain

Preview is not production. Success is production env and domain attached only to the production project, with auth and payment webhooks verified there.

  1. Step 01

    Name a maintainer for every exported route and primitive

    Files that exist only in the last canvas generation are imported under ownership or deleted. Point to the PR that last changed checkout and settings.

  2. Step 02

    Strip secrets the canvas left in the client

    Hunt `NEXT_PUBLIC_*` pastes, demo-embedded API keys, and service-role keys mirrored into browser calls. Rotate anything that appeared in a v0 prompt or public preview.

  3. Step 03

    Force a hard line between preview and the production project

    Separate Vercel projects or at least production env plus production domain. Preview gets a scrubbed dataset. Disable indexing on preview hosts.

  4. Step 04

    Verify auth and payment webhooks on the production project

    Callbacks list only the custom domain. Signatures verify against the production project—not a canvas-spawned preview.

  5. Step 05

    Attach the custom domain after rollback exists

    Production build from a clean CI checkout, error tracking on production releases, previous-deployment restore that does not regenerate UI in the canvas. Domain cutover is last.

Read next

Proof, the essay, and sibling intents

These pages are already on the site. Use them to pressure-test the bet before a call.

Internals

Related pages

Stay inside the vibe-coding cluster, or open booking and the Austin money page.

Before you book

Practical answers

Prefer writing? Send project details and we reply within one business day.

What does component ownership mean before you accept real users?

Every route and shared primitive from the export has a named maintainer, lives in the org repo, and changes only through review. Orphan files that exist only in the last canvas generation are either imported under ownership or deleted. If nobody can point to the PR that last changed a checkout or settings screen, you do not have ownership—you have a generated snapshot.

Which v0-generated patterns usually leak secrets into the client?

`NEXT_PUBLIC_*` (or equivalent) vars pasted from the canvas chat, API keys embedded in client components “to make the demo work,” and preview env files shared via link. Also: service-role keys mirrored into browser calls the export scaffolded for speed. Hunt the client bundle and git history for anything that ever appeared in a v0 prompt or public preview; rotate before production.

How do you gate a Vercel preview so it is not mistaken for production?

Separate Vercel projects (or at least production env + production domain) from PR previews. Disable indexing on preview hosts, use distinct OAuth redirect allowlists, and never point paying-customer DNS at a preview deployment. Team convention: only the production project receives production secrets; preview gets a scrubbed dataset. A preview URL is a review artifact, not a soft launch.

What must be true of the exported Next app before you attach a custom domain?

Production build succeeds from a clean CI checkout without an open v0 session; auth callbacks list only the custom domain; webhooks verify signatures on the production project; error tracking tags production releases; and a rollback path exists (previous deployment restore) that does not require regenerating UI in the canvas. Domain cutover is last—after those gates pass.

Attach the custom domain after the production project is honest.

Bring the exported tree and who can open Vercel. We will name owners, rotate client leaks, and say when a preview is still pretending to be live.

Book a Discovery CallEstimate cost & timeline

Prefer writing? Send project details on the contact page.