Do v0.dev apps have CSRF protection?

v0.dev does not generate CSRF protection tokens or middleware in its output. Applications built with v0-generated code that include state-changing operations like form submissions, account updates, or payment processing are vulnerable to cross-site request forgery without additional protection. Next.js Server Actions, which v0 sometimes generates, include built-in CSRF protection when used correctly, but standalone API routes do not. Developers need to implement CSRF tokens, SameSite cookie attributes, or origin checking manually. UNPWNED checks for CSRF vulnerabilities in deployed applications and recommends specific mitigation strategies.