AI code generator
From v0 by Vercel to production
Last verified: June 2026· v0 by Vercel productionization
What you typically have on day 0
The v0 by Vercel prototype is in roughly the same state for every team we've worked with. The good news: the production work is predictable.
- v0-generated React / Next.js components copy-pasted into an existing app, or a v0 Chat project deployed on Vercel
- Components use shadcn/ui + Tailwind, but the surrounding app is the team's existing codebase
- Auth: whatever the surrounding app uses (NextAuth, Clerk, Auth0)
- Data: whatever the surrounding app uses (Postgres, Supabase, PlanetScale)
- No code review of the v0-generated components beyond 'does it look right'
- No observability, no rate limits, no production hardening of the v0-generated pieces
The 12-axis production gap
For each of the 12 axes we score on every engagement, here's what v0 by Vercel typically has, and what production needs.
| Axis | What the prototype has | What production needs |
|---|---|---|
| Auth | Inherited from the surrounding app | Verify the v0-generated components use the app's auth correctly; add middleware-level checks on the routes v0 generated. |
| Data | Inherited from the surrounding app | Audit the v0-generated data fetches for RLS / authorization bypass; add data-layer guards at the API routes. |
| APIs | v0-generated client components + the app's existing API | Audit the API calls v0 generated for rate-limit awareness, error handling, and idempotency on writes. |
| Observability | Vercel Analytics only | Per-route latency + error rate on the routes v0 added; SLOs; alerting. |
| Security | No SAST, no review of v0-generated code | AI-aware SAST in CI scoped to the v0-generated files; secret scan; dependency audit on the packages v0 imported. |
| Compliance | Inherited from the surrounding app | Verify the v0-generated components don't bypass any compliance middleware the app already has. |
| DevOps | Vercel auto-deploy | Add a code-review gate on the v0-generated files; PR template asks for AI-tool attribution so reviewers know. |
The relevant v0 by Vercel surface
v0 Deployments → Vercel-owned deploy pipeline; production hardening is still on you.
The engagement
A 3–6 week hardening pass covers the 12 axes above. Same engineers we use for the LLM cost work + the AI-coding rollout + the Supabase productionization. The engagement ships:
- A 12-axis production-readiness scorecard marked "production" for every axis
- A production-grade auth, data, API, observability, security, and compliance layer — in your repo, owned by your team
- A runbook, a threat model, a compliance matrix, an audit artifact
- Named internal owners per axis; the team owns the system after we leave
Related
Frequently asked questions
How long does it take to take v0-generated code to production?
A focused 2–4 week hardening pass covers the audit + the production gaps v0 left. The 12-axis rubric is faster to run on a v0-augmented codebase than on a Lovable / Bolt prototype because the surrounding app already has most of the production primitives.
What is the difference between v0 and Lovable / Bolt?
Lovable and Bolt are app builders — they ship a working full-stack app from a prompt. v0 is a component generator — it ships React / Next.js components that you drop into an existing app. The production work is different: Lovable / Bolt is a full 12-axis hardening; v0 is an audit of the v0-generated pieces against the surrounding app's existing production primitives.
Should I attribute v0-generated code in PRs?
Yes. Add a PR template that asks for AI-tool attribution: which files came from v0, which from human review, which from v0 + human refinement. Reviewers treat AI-generated code differently — they look for the patterns that AI gets wrong (hallucinated APIs, missing edge cases, hardcoded values). The attribution makes the review better.
What is the realistic cost of auditing v0-generated code for production?
Smaller engagement than the Lovable / Bolt productionizations: $15–40k for a 2–4 week audit + hardening pass. Most of the work is verifying the v0-generated pieces against the app's existing production primitives.