Vibe-Code Rescue

Your AI-built app broke? Find the fix.

Plain-English fixes for Lovable, Bolt, Cursor, Replit and v0 apps that break after deploy, most common first.

149 fix guides, each with a Sources list of the official docs it was checked against and the date it was last reviewed.

All three fix packs · $49 one-time

Checklists and prompts for Supabase security, Stripe payments and deploys. One-time payment through Stripe, no subscription. Download after payment. Purchase questions go through the help form.

How it works

  1. Find your error. Pick it from the lists below, or open the page for the tool that built your app.
  2. Follow the free fix. Each guide explains the cause in plain English, gives the steps, and links the official docs it used.
  3. Keep it fixed, if you want. The $24 packs add checklists and prompts for Supabase, Stripe and deploys.

Top fixes from search

The 15 fixes that appear most often in Google search results. Each one starts with the short answer, then the steps.

  1. Supabase signup_disabled: new accounts are turned off

    Sign-up returns signup_disabled? Supabase's general Auth settings include Allow new users to sign up. When that is off, only existing users can sign in.

  2. OpenAI API key (sk-) is in the front-end code

    An OpenAI sk- key is in the browser bundle? OpenAI says never deploy a key in a browser. Revoke it and call the API from your server.

  3. Missing security headers: check HSTS, CSP, X-Frame-Options and nosniff

    A scanner says a security header is not set? Check all four at once: HSTS, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options, then fix each one on your host.

  4. 500: INTERNAL_SERVER_ERROR / FUNCTION_INVOCATION_FAILED on Vercel

    Investigate a Vercel function failure using runtime logs, environment checks, Node compatibility, database connections and local reproduction.

  5. Vercel custom domain shows "Invalid Configuration"

    Added your domain to Vercel and it says Invalid Configuration? Set the DNS records Vercel shows at your registrar and wait for DNS.

  6. Clerk sign-in keeps redirecting in a loop

    The app bounces between the page and Clerk sign-in forever? The redirect target is protected too, or the force-redirect URL points back at the gate.

  7. Lovable custom domain not working or stuck pending

    Connected your own domain to Lovable and it won't load or stays pending? Check the DNS records Lovable gives you and remove conflicting ones.

  8. Replit app works in preview but not when published

    Replit Preview works and publishing fails, or the public URL does not? Check the Publishing logs, production secrets, 0.0.0.0, and the five-second health check.

  9. Webhook signature verification failed. No signatures found matching the expected signature for payload

    Stripe webhook fails signature check? Usually the wrong whsec_ secret or your framework changed the raw request body. Here's the fix.

  10. supabaseUrl is required

    The console says supabaseUrl is required? createClient got an empty URL. Set the project URL the code reads, then rebuild.

  11. Bolt custom domain will not connect

    Bolt will not attach your domain, or the status stays on a DNS warning? Publish first, then use the records Bolt shows. An AAAA record will not connect it.

  12. Lovable custom domain stuck on Verifying or Unable to verify

    Your Lovable custom domain sits on Verifying or shows Unable to verify? Lovable can't see its A and TXT records yet. Fix the records, turn off proxying, and recheck.

  13. permission denied for table (Supabase error 42501)

    Supabase "permission denied for table"? The role lacks a GRANT on the table, which is checked before RLS. Add the grant, then a policy.

  14. Supabase login redirects to localhost:3000 after deploy

    Login or email confirm sends users to localhost:3000 on your live site? Change Supabase's Site URL and add your domain to Redirect URLs.

  15. Netlify secret scanning failed the build

    Netlify stopped the deploy because secret scanning found a key in the repo or the build output? Remove that value, then deploy again.

Fixes by problem area

Pick the kind of problem you have. Each group links to the fixes we keep up to date.

Sign-in and email

Users can't sign up, get bounced back to the login page, or never get the confirmation email. These are the auth errors people search for most on Supabase, Clerk and Lovable apps.

Custom domains and HTTPS

The app works on its preview link but not on your own domain, or the domain is stuck on verifying, SSL or "Invalid Configuration".

Deploys and builds

It worked in the editor and broke once it went live: 404s on refresh, 500s from functions, missing environment variables, or a build that fails.

API keys and security

Keys that ended up in the browser, keys that are rejected, and the security headers a scanner says are missing.

Database, functions and payments

Supabase permission and row-level security errors, Edge Function 401s, and Stripe webhooks that fail signature checks.

Browse by platform

Every fix for one tool, on one page.

Free first. Pay only for the checklist.

Every step is optional. There is no done-for-you repair and no subscription.

  1. Free

    Fix guides and the leak check

    Paste a public address. The check reads the HTML and that site's own scripts, then flags server keys and three missing security headers. The URL and the results are not saved.

    Open leak check

  2. $15

    Deep leak report

    Offered after a finished free scan: up to 25 same-origin scripts, public source maps, reachable /.env or /.git/config, and the rest of the security headers, as an HTML report and a PDF.

    Start with the free scan

  3. $24

    One fix pack

    Supabase Launch Safety Pack · Stripe Payments That Work Pack · Deploy Without Errors Pack

  4. $49

    All three packs

    $72 bought separately. All Packs Bundle

Compare the packs

Comparisons

No failure-rate scores. These pages compare what Lovable, Bolt, Cursor, Supabase, Firebase, Vercel, and Netlify document.

Before you buy

Are the fix guides free?

Yes. All 150 guides are free to read. Each one lists the official docs it was checked against and the date it was last reviewed.

Will you fix my app for me?

No. There is no done-for-you repair. The guides and packs are self-serve: you, or the AI tool that built the app, make the changes.

What do I get for $49?

One ZIP with all three fix packs: Supabase Launch Safety, Stripe Payments That Work, and Deploy Without Errors. They are $24 each, or $72 bought separately.

Is it a subscription?

No. Each pack, the bundle and the deep leak report are a one-time payment. Purchases made on this site are paid through Stripe. Purchases made through a “Buy on Whop” link are paid on Whop.

How do I get the files after paying?

After a purchase made on this site, Stripe sends you straight back to a download page on this site with a Download the ZIP button. If you bought on Whop, Whop emails you a sign-in code; enter it and you land in the Vibe Code Rescue hub. Open the pack’s download item (for example “Stripe Payments That Work Pack download”), then the lesson, then the Attachments tab to save the ZIP.

Which pack fits my app?

Pick your tool under Browse by platform. Each platform page lists the fixes for that tool.

Does the free leak check store my URL?

No. It reads the page’s HTML and that site’s own scripts, flags server keys and three missing security headers, and does not save the URL or the results. The $15 deep leak report is optional.

Are you part of Lovable, Bolt, Cursor or Replit?

No. Vibe-Code Rescue is not affiliated with those products, or with Supabase, Stripe, Vercel or Netlify.

My error isn’t listed. What now?

Look under Fixes by problem area, or open your tool’s platform page. Questions about the site or a purchase go through the help form. Open the help form.

Shipping an AI-built app this week?

Checklists and prompts for Supabase security, Stripe payments and deploys.

One-time payment through Stripe, no subscription. Download after payment. Purchase questions go through the help form.