Skip to content
SSShipSafeStack

Ship guide

Ship a v0 app

v0 generates a real Next.js-style project and can deploy it on Vercel or open a pull request. The UI can look finished while server actions and route handlers still trust the client. Review the diff as if a new teammate wrote it.

Updated 16 Oct 2026 · Directory entry

A checklist for this builder, not a promise the app is production-safe. Confirm every setting in the project you actually generated.

  1. 01

    Read the pull request, not only the preview

    Open the files the agent changed. Look for secrets, database calls inside client components, and server actions that do not check the session. The preview being pretty is not the review.

  2. 02

    Sort environment variables

    On Vercel, NEXT_PUBLIC_ values ship to the browser. Everything else stays on the server only if you did not import it into a client component. Use the API key checklist.

  3. 03

    Protect preview URLs that have real data

    Vercel previews are often public. Turn on deployment protection before a preview points at production data. See the Vercel entry.

  4. 04

    Authorize every server action

    A server action is still an HTTP endpoint. If it updates a row, it must check who is calling. Database choice is separate: Supabase, Firebase, Neon, or Convex.

  5. 05

    Add limits and a webhook check

    Follow rate limiting on auth and AI routes, and the Stripe webhook checklist if you charge cards. Finish with the pre-launch checklist.