AI-generated applications often need to authenticate to external services on behalf of their users. That creates a problem: generated code shouldn't have access to the user's credentials.

We faced that decision when building the v0 Snowflake integration . It lets users connect Snowflake, inspect schemas, query data, and generate applications that run against their warehouses. That generated code has to authenticate to Snowflake, but it is written by a model and runs without human review, and prompt injection can steer it into exfiltrating whatever it can read , so the user's OAuth token should never enter the environment the code runs in.

We solved this with a Snowflake request proxy for v0 sandboxes, built on the Vercel Sandbox firewall . The sandbox can run normal Snowflake clients, but the real credential is resolved at request time in a server proxy outside the sandbox runtime.…