DEV Community

I built a social app where developers can share code, fork each other's snippets, and co-write posts live

JammyVibez on August 05, 2026

Most social platforms treat developers like everyone else — a text box and a like button. I wanted a feed that actually understands code, so I buil...
Read full post
Collapse
 
amitfeldman profile image
Amit Feldman •

Congrats on the launch! I ran a quick check on loop-app-xi.vercel.app and found two things worth fixing early:

  1. The page ships no <title>, meta description, or <h1> to crawlers — it's all client-rendered. Google will index a blank shell. If you're on Next.js, move the landing page to SSR/SSG (or add metadata in the root layout) so the title/description exist in the initial HTML.

  2. Content-Security-Policy is missing (plus X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). On Vercel it's one vercel.json block:

{
  "headers": [{
    "source": "/(.*)",
    "headers": [
      { "key": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" },
      { "key": "X-Frame-Options", "value": "DENY" },
      { "key": "X-Content-Type-Options", "value": "nosniff" },
      { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" }
    ]
  }]
}
Enter fullscreen mode Exit fullscreen mode

Happy to run a full free scan of the whole site if you want the complete picture — just say the word.

Collapse
 
jammyvibez profile image
JammyVibez •

Thanks Amit, really helpful catch, especially this early.
You’re right on both. The metadata was already defined in the Next.js root layout, but Next 15 was streaming it after for Googlebot, and our auth loading gate was blanking the shell before any

could render. Fixed that so title, description, and an

are in the initial HTML now.
Also added CSP + the other security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Went with a slightly broader CSP allowlist so Supabase, Cloudinary, Stripe, and Google OAuth keep working.

Would love the full free scan once this deploys, appreciate you taking the time 🙏

Collapse
 
amitfeldman profile image
Amit Feldman •

Small update since this morning: the Launch-Ready Quick Scan is now $29 for the launch period (was $49) — same 24h deep pass: auth-flow edge cases, staging-vs-prod header drift, perf budget, and a prioritized launch checklist. If $49 was the sticking point, it's at afeldman2.gumroad.com/l/keikf.

The unsafe-inline/eval and TTFB notes above are yours to keep regardless — good luck with launch week 🙌

Collapse
 
jammyvibez profile image
JammyVibez •

Appreciate the update, makes sense on the discount. Still tightening things up on my end before a real launch push, so I'll hold off for now, but I'll reach out when I'm closer to that point. Thanks again for the case study and the solid findings so far 🙌

Collapse
 
madman8 profile image
Mad Man 8 •

Congrats on the launch! One remark that popped up right away was the color of text on the sign up page in light theme. It's a little hard to read for me. Dark theme looks great btw!

Collapse
 
jammyvibez profile image
JammyVibez •

Appreciate you flagging this, you're right, that's rough in light theme. Already tracking a few theme-contrast issues, adding this to the list. Thanks for the heads up 🙏

Collapse
 
amitfeldman profile image
Amit Feldman •

Sounds like the right call — get the auth flows locked and the launch out the door first, the scan will still be there. The re-scan offer stands whenever the TTFB and CSP tightening land, no strings attached. Good luck with the launch push 🙌