Security for apps built with v0 by Vercel

v0 generates beautiful Next.js UI, but it tempts you into calling APIs straight from client components — and with production source maps enabled your entire source (keys included) is readable in the browser.

The fix: keys go in Vercel Environment Variables, AI goes through Next.js API routes, and turn off productionBrowserSourceMaps in next.config.js.