The rule. Treat Publish as a release decision: v0 deploys your chat to a live production URL on Vercel, so decide who can reach it before you send the link.
Why. Publish to Production builds the chat and puts the app live at a unique Vercel URL (Vercel, n.d.). The default is open: deployments on automatically assigned vercel.app addresses, without a custom domain and not otherwise locked down, are public and indexable by Google and other search engines (Jared, 2025). Protection is real but tiered: Vercel Authentication with Standard Protection is available on every plan including the free one, where it covers preview deployments and deployment URLs while the production domain remains publicly accessible; protecting production domains requires Pro or Enterprise (Vercel, 2026).
Seen in the wild. Free-plan deployments carry a "Built with v0" badge that links visitors back to the v0 project that generated the app, so an unprotected prototype ships with its own provenance attached (Vercel, n.d.).
Verified as of 2026-08-25 against current v0 and Vercel documentation.