A checklist for apps built with Lovable, Bolt, Replit or Cursor. Run it before you show the app to anyone.
Use a real email, not your dev account. Does the confirmation email arrive? Does its link go to your production domain, or to localhost or a preview URL? In Supabase, the usual cause is the "Site URL" and the redirect URL list under Authentication settings.
Run the same test. Reset breaks more often than sign-up because nobody tries it until a customer does.
Log in as user B and try to load user A's records by changing an ID in the URL or in a network request. If you get the data, row-level security is off or too loose on that table.
Test mode working proves little. Check that the live webhook endpoint exists, that it uses the live signing secret, and that a real $1 purchase actually updates the user's plan in your database.
Send to a Gmail and an Outlook address. If either lands in spam, set up SPF and DKIM on the sending domain.
Open DevTools, go to Sources, and search for sk_, service_role and secret. Anything you find there is public. Rotate the key first, then move that call into a server function.
If it works in preview and breaks on your domain, compare the environment variables between the two before touching any code.
If each fix from the builder breaks two other things, stop prompting. Read the error in the browser console and the server logs. It's usually one config value.
Get a free “what's broken” report on your app
We run these checks on your live URL as a regular user and send you the failures with screenshots. Fixing them is $249.