I've been fixing apps built with Lovable, Bolt, Replit and Cursor that got stuck right before launch. The same few things break almost every time, so here's the checklist. Run it on your app before you show it to anyone.
- Sign-up in a private window. Real email, not your dev account. Does the confirmation email arrive? Does the link go to your production domain or to localhost/a preview URL? (Supabase "Site URL" and redirect URLs are the usual cause.)
- Password reset. Same test. It's broken more often than sign-up.
- Row-level security. Log in as user B and try to load user A's records by changing an ID in the URL or the network request. If it works, RLS is off or too loose.
- Stripe in live mode. Test mode working proves little. Check that the live webhook endpoint exists, that its signing secret is the live one, and that a real $1 purchase actually updates the user's plan in your database.
- Email deliverability. Send to a Gmail and an Outlook address. If they land in spam, set up SPF/DKIM on your sending domain.
- Secrets in the bundle. Open DevTools > Sources and search for "sk_", "service_role" and "secret". Anything there is public. Rotate it, then move the call to a server function.
- Env vars in production. If it works in preview and breaks on your domain, compare the env vars between the two environments first.
If the AI builder keeps "fixing" one of these and breaking two others, stop prompting and read the error in the browser console and the server logs. It's usually one config value.
Happy to answer questions in the comments. Disclosure: I run App Finisher, which does free "what's broken" reports on live apps: https://finish.harveycreative.co/?src=devto
Top comments (0)