v0 is Vercel's AI app builder, and in 2026 it's a different product from the one most reviews describe. It started as a React component generator. Since a February 2026 rebuild it imports GitHub repositories, runs real previews in a sandboxed VM, and publishes by opening and merging a pull request. Since June 2026, new apps that need a database and login scaffold with Neon, Drizzle and Better Auth by default. That makes it full-stack, which changes the security question. This review covers what it costs, what you can take with you, and where the risk sits now.
TL;DR
v0 turns prompts into a standard Next.js app with Tailwind and shadcn/ui, deploys it on Vercel, and can keep the code in a private GitHub repo that's yours. The exit is the best of the hosted builders: real code, real provider databases, and a FAQ that says you can deploy elsewhere. The weak spots are token billing, a free plan cut to a one-time $5 credit for new users, and training defaults that vary by plan. Our rating: 3.4 out of 5.
Our Verdict
Use with Caution| What we scored | Score | Why |
|---|---|---|
| Speed to a working app | 4/5 | Strong UI output, one-click Vercel deploys, and database plus auth scaffolding built in since June 2026 |
| Code ownership and exit | 5/5 | Private GitHub repo you own, standard Next.js code, databases provisioned as your own provider accounts |
| Pricing predictability | 2/5 | Token-based billing, context counts as input, failed attempts cost credits, and the free tier is now a one-time $5 for new users |
| Security defaults | 3/5 | PR-based publishing, NEXT_PUBLIC_ warnings and command prompts are good. No app security scan, and training defaults depend on plan |
| Overall | 3.4/5 |
What's Good
- The code is a standard Next.js app in a private GitHub repo you own, so leaving doesn't mean a rewrite
- v0 never pushes directly to
main. Publishing goes through a pull request, and required checks and reviews still block it - Analyzes
NEXT_PUBLIC_usage and warns when a secret is about to ship to the browser - Asks before each terminal command it runs (since May 12, 2026)
- Databases come from Neon, Supabase, Upstash or Vercel Blob as your own accounts, not a proprietary backend
What to Watch
- Token billing: chat history and source files count as input, so long chats cost more per message
- New free users get $5 of credits once, not monthly, plus a 7-message daily cap
- No documented security scan for the app v0 builds, unlike Base44 or Lovable
- Training is on by default for Hobby-tier Vercel accounts, and v0's docs disagree on who can opt out
- New team chats are visible to the whole team by default (since September 10, 2026)
How we reviewed this. We worked from v0's pricing, security, GitHub, databases and FAQ docs, its changelog, Vercel's March 2026 terms-of-service update and April 2026 security bulletin, Okta Threat Intelligence's July 2025 report, and v0's Trustpilot page, all read on 2026-10-13. We pair this review with our Is v0 Safe? security analysis and our v0 security checklist. We haven't run a timed hands-on build for this page, so the speed score reflects documented features and user reports, not our stopwatch. Vercel didn't sponsor or review this page.
What v0 Actually Builds
v0's FAQ lists the stack plainly: "v0 uses Next.js, React, TypeScript, Tailwind CSS, and shadcn/ui." That's the whole frontend story, and it's a mainstream one. Any Next.js developer can pick the code up.
The backend side grew in 2026. The February rebuild added GitHub import, Projects (which tie chats to a real Vercel project with its environment variables and domains), a VS Code-style editor, and previews that run your app in a Vercel Sandbox VM instead of the browser, so API routes and database calls work before you deploy. The June 8, 2026 changelog adds the default that matters most here: "New apps that need a database and authentication now scaffold with Neon, Drizzle, and Better Auth by default."
Databases are added through the Vercel Marketplace. Per v0's databases docs, that "provisions a new user account on that service and adds the necessary environment variables to your project," and for SQL integrations v0 "can generate and execute SQL," including creating and dropping tables.
v0 can run SQL against your real database. That's useful when you're building and alarming once you have users. Point it at a development branch of your Neon or Supabase database, not production, and keep production credentials out of the project v0 is working in.
Pricing and Credits
Here's what v0's pricing docs list as of 2026-10-13:
| Plan | Price | Included credits | Notable |
|---|---|---|---|
| Free | $0 | $5 once for new users, plus a 7-message daily cap | Deploy to Vercel, GitHub sync |
| Plus | $30 per user/month | $30 per user/month | Shared projects, shared credit pool |
| Business | $100 per user/month | $30 per user/month | Data opt-out |
| Enterprise | Custom | Custom | SAML SSO, RBAC |
A $20 Premium plan still exists for existing subscribers but, per the same page, "is no longer available to new users." The Team plan was renamed Plus on July 21, 2026.
The free tier is the change to notice. New users who sign up under the current offer "receive $5 once per user," and "a one-time allowance does not renew." Existing free users keep a $5 monthly allowance. If you read an older review that calls v0's free plan generous, it was written before this.
Credits are a prepaid balance spent on tokens, and "when credits are used up, generation pauses." Unused monthly credits roll over and expire after 65 days. Purchased credits last a year but need an active paid plan to spend. The cost per message isn't fixed: v0 counts "chat history, source files, and Vercel-specific knowledge" as input, so the same prompt costs more in a long chat than a fresh one. Model choice moves the rate too.
Start a new chat for each feature. Because history counts as input, one sprawling chat gets more expensive with every message. v0's GitHub flow is built for this: each chat gets its own working branch, and they all share the same repo and Vercel project.
Security: The Short Version
Our Is v0 Safe? page covers the audit steps. For a buying decision, split it into the platform and the app.
The platform is careful about your repo. Per v0's GitHub docs, connecting creates a private repository, v0 commits to its own working branch, and it "never pushes directly to main." Publishing opens or reuses a pull request, merges it, and deploys, and "required checks, required reviews, draft pull requests, and other branch protections can block the merge." Since May 12, 2026 it asks before each terminal command it runs. Its security docs say v0 analyzes NEXT_PUBLIC_ usage and warns about secrets headed to the browser, and the July 21, 2026 changelog records fixes to v0's own sign-in: a magic-link CSRF and session-fixation issue, open redirects, and OAuth callbacks attaching credentials to the wrong account.
The app is yours. We found no security scan for generated apps in v0's docs. Better Auth gives you sign-in, but it doesn't decide which API routes check the session, and that's where AI-built Next.js apps usually go wrong. Before launch, open every file under app/api/ and confirm each one checks who's calling it.
Environment variables live on Vercel. In April 2026 Vercel disclosed unauthorized access to internal systems, and initially found that a limited subset of customers' non-sensitive environment variables (the kind that decrypt to plaintext) were compromised. Those customers were told to rotate credentials. The practical lesson for a v0 user: mark API keys and database URLs as Sensitive in your Vercel project. Since July 21, 2026, v0's changelog says variables added in v0 reach published apps on teams that enforce Sensitive Environment Variables, so turning that on no longer breaks your deploys.
Abuse isn't the same as risk to you. In July 2025, Okta Threat Intelligence reported attackers using v0 to build fake sign-in pages for multiple brands, with resources like the impersonated logos hosted on Vercel too. Vercel restricted access to the sites Okta found. That's a story about what v0 makes easy for attackers, not a flaw in apps you build with it.
Who Sees Your Prompts
This is the messiest part of v0's documentation, so here's every source side by side:
- v0's pricing table lists "Data Opt-out" as available on Business and Enterprise only.
- The pricing page lists "Training opt-out by default" as a Business feature.
- v0's FAQ says content from Enterprise customers "or any customer that has opted out of model training in their Vercel settings, is not used for training."
- Vercel's March 2026 terms update says Hobby accounts are "opted in for AI model training by default," Pro accounts are opted out by default, and Enterprise is opted out of all training.
Our read: on a free or Hobby-tier account, assume your prompts and code can be used for training unless you've changed it. Go to Team Settings (not Account Settings), then Data Preferences, and check the toggle. If you're on Plus and it matters, ask Vercel which document governs your account before putting customer data in a prompt.
One more default worth knowing: since September 10, 2026, new chats in a team workspace are visible to the whole team unless the owner changes Default Chat Visibility. On October 6, 2026, personal v0 accounts were converted into team workspaces, so check that setting even if you work alone.
Code Ownership and Leaving
v0 has the cleanest exit of the hosted builders we've reviewed.
- Code. GitHub sync creates a private repo in the account or organization you choose, and v0's docs say the repo "becomes the source of truth for your project's code." It's a standard Next.js app with no proprietary SDK in the middle.
- Hosting. v0 is built for Vercel, but its FAQ says "You can still export code and deploy elsewhere." You'd lose the one-click publish, not the app.
- Data. Databases added through the Marketplace are accounts with Neon, Supabase or Upstash themselves. Your data sits with that provider and leaves with whatever export tools they offer, independent of v0.
The one warning in the GitHub docs is the flip side of owning it: "If you delete the repository, the code may become unrecoverable."
What Users Say
v0's Trustpilot page is unclaimed and small: a 1.9 out of 5 TrustScore from 30 reviews when we read it, about 81% of them one-star. That's too few reviews to say much about the product as a whole, but the complaints are consistent: credits running out after a handful of messages, being charged for attempts that didn't work, and a project locked until the owner upgraded. The praise, what little there is, centers on clean UI output and readable code.
v0's own FAQ includes the question "Why do v0 agents keep failing and consuming my credits?" The answer is to send feedback. If you hit that loop, stop, read the error yourself, and give v0 the exact message and file rather than "still broken".
Who v0 Is For
A good fit if you want polished UI fast, you're happy on Vercel, and you value owning standard code you or a developer can take over later. It's the best of the builders for handing a project to an engineer.
A poor fit if you want to stay on the free plan, need a fixed monthly cost, or want the builder to audit your app's security for you.
v0 Alternatives
People most often weigh v0 against Lovable, Bolt, Replit and Base44.
- Lovable and Bolt build on Supabase, and Lovable adds its own security scans (Quick and Deep) plus RLS on by default. See our Lovable review, Bolt.new review, and the Lovable vs v0 comparison.
- Replit gives you a fuller IDE and separate dev and production databases. See our Replit review and v0 vs Replit.
- Base44 handles the most for you, security scan included, but keeps the backend on its own platform. See our Base44 review.
v0's edge is the exit: of these, it's the one where leaving costs the least.
Is v0 worth it?
It's worth it if you want real Next.js code you can take anywhere, you're happy hosting on Vercel, and you'll keep an eye on token spend. It's a weaker deal on the free plan, which new users now get as a one-time $5 credit with a 7-message daily cap, and for anyone who needs a predictable bill, since long chats and failed fixes both burn credits.
How much does v0 cost?
v0's pricing docs list Free at $0, Plus at $30 per user per month, Business at $100 per user per month and custom Enterprise pricing. Plus and Business each include $30 of credits per user per month. A $20 Premium plan still exists for existing subscribers but is closed to new users. Usage is billed by tokens, so the credit balance, not the plan price, is the real limit.
Can I export my code from v0?
Yes. Connecting GitHub creates a private repository in your account and every change is committed to it. The code is a standard Next.js app with Tailwind and shadcn/ui, and v0's FAQ says you can export it and deploy elsewhere. Databases added through the Vercel Marketplace are accounts with the provider itself (Neon, Supabase, Upstash), so your data is not trapped in v0 either.
Is v0 safe for production apps?
The platform is reasonable: it never pushes to main, publishes through pull requests that respect your branch protection, warns about secrets in NEXT_PUBLIC_ variables, and asks before running terminal commands. The app it writes is your responsibility, and v0 has no built-in app security scan in its docs. Mark environment variables as Sensitive in Vercel, check every API route for an auth check, and scan the deployed URL before launch.
Does v0 train on my code?
It depends on the plan, and v0's own pages don't fully agree. The pricing table only lists a data opt-out on Business and Enterprise, the pricing page says Business is opted out by default, and the FAQ says content from anyone who opted out in their Vercel team's Data Preferences isn't used. Vercel's March 2026 terms opt Hobby accounts in by default and Pro accounts out. Check Team Settings, then Data Preferences, on day one.
Built something with v0?
Scan the deployed URL for exposed keys, open files, missing headers, and TLS issues. No signup needed to see your first results.