Does v0.dev add server-side validation?

v0.dev primarily generates client-side UI code and does not produce server-side validation logic for form submissions or API requests. Client-side validation created by v0 can be easily bypassed by attackers using browser developer tools or direct API calls. Any form fields, input constraints, or data type checks in v0-generated components exist only for user experience and provide no security guarantee. Developers must implement server-side validation separately in their API routes or server actions. UNPWNED tests whether your application properly validates input on the server side, catching cases where client-only validation leaves endpoints exposed.