Is v0 Safe to Ship From? What Vercel's Generator Does (and Doesn't) Check

v0 generates real Next.js on real Vercel infra. Here's the env var that leaks to the browser, the service role key, and the server action nobody checks.