Platform

v0 breaks

v0 breaks: NEXT_PUBLIC_ secrets, a client component that renders a server env var, and Firebase or Supabase rules in the generated app. For your own app.

11 cards are tagged v0. Symptoms in this set: Exposed data, Secrets, Payments, Over-open rules, Auth. Open a card for the root cause, the fix prompt, and the self-check. The check is only for an app you own.

• Exposed data

  Supabase tables ship with row level security off

  The app looks correct while you are signed in. A request that carries only the publishable key, and no user session, can still read or write a table.

• Exposed data

  A policy uses USING (true) on private rows

  Row level security is on, and the app still returns every row to any signed-in user, or to nobody at all.

• Secrets

  The service role key is in the browser bundle

  Data API calls from the site ignore every row policy. Searching the shipped JavaScript turns up a secret or service role key.

• Secrets

  NEXT_PUBLIC_ inlines a secret at build time

  A key was added as NEXT_PUBLIC_ so a client component could read it. The production bundle contains the value.

• Secrets

  A Client Component reads a server environment variable

  The variable is not prefixed NEXT_PUBLIC_, but the secret still shows up in the HTML of a page that renders a Client Component.

• Payments

  The Stripe webhook accepts an unsigned body

  A payment shows as paid, or a paid feature unlocks, when a request hits the webhook URL without a valid Stripe signature.

• Over-open rules

  Firebase rules allow every read and write

  The app was created in Firebase Test mode, or the rules say allow read, write: if true. Anyone who knows the project can read and overwrite the data.

• Over-open rules

  Any signed-in Firebase user can read the whole database

  Signed-out visitors are blocked. Any account, including one you just created, can read and write every document.

• Over-open rules

  A deeper Firebase rule cannot take access away

  A child path sets ".read": false, and clients can still read it.

• Auth

  OAuth comes back to the wrong host

  Google or GitHub sign-in leaves the user on localhost, on a preview URL that errors, or on the site with an error in the URL hash.

• Auth

  The UI hides a page, and the API does not

  The admin screen is hidden unless a localStorage flag is set. The request that loads the data still succeeds without that flag.