Does v0.dev sanitize user inputs?

v0.dev generates form components with basic HTML input types and optional client-side constraints like required fields and pattern matching, but does not include input sanitization logic. User input rendered through React JSX is escaped by default, which prevents basic XSS in most cases. However, inputs submitted to APIs, stored in databases, or used in server-side operations are not sanitized in v0-generated code. Developers must add libraries like zod or yup for data validation and cleaning on the server. UNPWNED tests your application endpoints for injection attacks that exploit missing sanitization regardless of the frontend framework used.