The Free Vibe-Code Fix Checklist
19 checks that catch the most common breaks in apps built with Lovable, Bolt, v0, Replit and Cursor, before your users find them.
Get it in your inbox, plus the weekly fix digest
Security
- ☐ Row Level Security is ON for every Supabase table.
- ☐ Every table has policies for exactly who can read, insert, update and delete.
- ☐ No secret keys (service_role, Stripe secret, OpenAI) in front-end code or VITE_/NEXT_PUBLIC_ variables.
- ☐ Storage buckets are private unless the files are meant to be public.
Login
- ☐ Supabase Site URL is your live domain, not localhost.
- ☐ Redirect URLs include your live, preview and local addresses.
- ☐ Sign-up, password reset and Google login all tested on the live site in a private window.
- ☐ Protected pages wait for the session to load before redirecting.
Deploy
- ☐ All environment variables are set in your host, with the right prefix, and you redeployed after adding them.
- ☐ Refreshing a deep link (like /dashboard) does not 404.
- ☐ Custom domain and SSL work for both www and the bare domain.
- ☐ The production build passes with no errors.
Payments
- ☐ Live mode uses live Stripe keys, prices and webhook endpoint.
- ☐ Webhook signature is verified and the paid feature unlocks after checkout.
- ☐ A real test purchase works end to end, then refund it.
Reliability
- ☐ The browser console on the live site shows no red errors.
- ☐ Every loading spinner stops on errors too.
- ☐ Your free Supabase project is not about to pause, and you have a backup.
- ☐ Your code is on GitHub so you can roll back.
Print this page (Ctrl/Cmd+P) to save it as a PDF.
Failed a check?
Get a free diagnosis, or have us run the full $9 App Health Check.
Get a free diagnosis