# v0 app security checklist for a live Next.js site

By Mark Kashef, founder of Lockpick. Published 2026-10-08, updated 2026-10-08.

How environment variables, server code and the live site fit together in an app built with v0, and what to check before you share it.

An app built with v0 is a Next.js app, so the main rule is the Next.js one. Anything with the `NEXT_PUBLIC_` prefix is public, and everything else stays on the server. Atlas, our example app at atlas.example, shows how to check it.

## Which variables reach the browser?

v0 says only variables prefixed with `NEXT_PUBLIC_` are exposed to the browser. Next.js inlines a `NEXT_PUBLIC_` value into any JavaScript sent to the browser. That makes the prefix a decision about publishing, not a naming style.

| Variable | Prefix | Who can read it |
| --- | --- | --- |
| Analytics site id | `NEXT_PUBLIC_` | Anyone who opens the site |
| Database publishable key | `NEXT_PUBLIC_` | Anyone, so access rules must protect the data |
| AI provider or payment secret key | none | Only your server code |

v0 analyzes `NEXT_PUBLIC_` usage and warns about potential security risks. Its own docs say never to expose sensitive tokens with the `NEXT_PUBLIC_` prefix. If a secret ever had the prefix, assume it was published and replace it.

## Where should a call with a secret run?

In a Route Handler or a Server Action, never in a client component. The browser calls your route, and your route calls the provider with the key. The key never leaves the server.

## How to check the live site

1. Deploy the app and copy its production address.
2. Run a [quick check](/check) on your published address to see what a stranger sees, then read [how we check](/docs/security/how-we-check) for what it covers.
3. Paste each fix prompt into v0, review the change and deploy again.

An outside check reads the scripts your live site serves, so it can spot a key that slipped into the bundle. It cannot read your Vercel project settings or your server code.

## Questions people ask

### Is every NEXT_PUBLIC_ variable a leak?

No. Many public values are meant to be public. It is a leak only when the value is a secret, like a payment or AI provider secret key.

### Does renaming a variable remove it from a live site?

Only after you deploy again. The old value stays in the built files until a new build replaces them, so replace the key too.

## Sources

- [How to use environment variables in Next.js](https://nextjs.org/docs/app/guides/environment-variables), Next.js docs, read on 2026-10-06
- [Security](https://v0.app/docs/security), v0 docs, read on 2026-10-06