v0, Next.js, and client-visible config

Q: Are v0 environment variables private by default?

Server variables are private to the server runtime. The `NEXT_PUBLIC_` prefix opts a variable into the client bundle. A literal in a client component is public even with no env var at all.

v0 generates Next.js apps. NEXT_PUBLIC variables and client components are visible to every visitor. Server secrets stay in server code.

Updated 2026-10-27

v0 output is a Next.js app, and any value prefixed NEXT_PUBLIC_ is shipped to the browser. Treat that prefix as a publication switch. The same is true of a string literal inside a client component, which is a file with "use client" at the top or a component imported by one.

The anon key for Supabase and the web apiKey for Firebase are reasonable NEXT_PUBLIC_ values. A service role key, a Stripe secret key, an OpenAI key, and a database URL with a password are not. v0 will follow a prompt that says "add the key to the env example and the client". Read the diff before you deploy. The generator does not know which key bypasses your database rules.

Where a secret is allowed

Server components, route handlers under app/api, and middleware that never returns the secret can read normal environment variables. Those variables have no public prefix. Vercel and similar hosts inject them into the server runtime. They do not appear in the JavaScript chunk for the page unless your code imports them into a client module.

A common slip is a shared lib/supabase.ts that creates a client with the service role and is then imported by a client component. The bundler includes the module. The key is in the chunk. Split the file: a browser client that uses the anon key, and a server client that is only imported from server files.

Next.js server actions are server code, but their arguments and return values are visible to the caller. Do not return a secret from an action. Do not trust an action as your only access check if the underlying table has no row level security. The browser can call PostgREST directly with the anon key and skip your action. See the Supabase RLS guide.

What to review in a v0 diff

.env.example should list public variable names without real secret values.
Client components should not contain private key material.
next.config should not set a custom environment map that copies every server variable into the client.
Source maps on the production deployment should be off unless you have a reason and an access control.

If a scan of the deployed URL finds a private key pattern, rotate the key. The v0 chat history is not the production source of truth. The deployed bundle is.

FAQ

Are v0 environment variables private by default?

Server variables are private to the server runtime. The NEXT_PUBLIC_ prefix opts a variable into the client bundle. A literal in a client component is public even with no env var at all.

Can I fetch the key from an API route at runtime to keep it out of the bundle?

Only if the route refuses to send it. An API route that returns the key to the browser is the same leak, one request later.

Does the Firebase apiKey in a v0 component need to be hidden?

No. Lock down Realtime Database, Firestore, and Storage with security rules. The apiKey identifies the project. The Firebase rules guide covers the rules that actually matter.