Do v0.dev apps have CSRF protection?

v0.dev does not generate CSRF protection tokens or middleware in its output. Applications built with v0-generated code that include state-changing operations like form submissions, account updates, or payment processing are vulnerable to cross-site request forgery without additional protection. Next.js Server Actions, which v0 sometimes generates, include built-in CSRF protection when used correctly, but standalone API routes do not. Developers need to implement CSRF tokens, SameSite cookie attributes, or origin checking manually. UNPWNED checks externally observable form and cookie indicators, but it does not prove CSRF exploitability or server-side defenses. Paid reports add remediation guidance for completed findings.