Vibe-Code Rescue

Your AI-built app broke? Find the fix.

Plain-English fixes for Lovable, Bolt, Cursor, Replit and v0 apps that break after deploy, most common first.

150 fix guides, each with a Sources list of the official docs it was checked against and the date it was last reviewed.

All three fix packs · $49 one-time

Shipping an AI-built app this week?

Checklists and prompts for Supabase security, Stripe payments and deploys.

The three packs are $24 each, $72 bought separately. The bundle is all three for $49.

One-time payment through Stripe, no subscription. Download after payment. Purchase questions go through the help form.

Which tool built your app?

Show fixes for

150 fixes for AI-built apps

Most common problems first.

  1. Rank 1. Supabase login redirects to localhost:3000 after deploy

    Login or email confirm sends users to localhost:3000 on your live site? Change Supabase's Site URL and add your domain to Redirect URLs.

  2. Rank 2. Invalid API key (Supabase)

    Supabase says "Invalid API key" on your live site? Usually the key or project URL env var is missing, mistyped, or from another project.

  3. Rank 3. Environment variables are undefined in production

    Works locally but env vars are undefined once deployed? Add them to your host, use the VITE_ or NEXT_PUBLIC_ prefix for browser code, then redeploy.

  4. Rank 4. Lovable app is a blank white or black screen after publish

    The published Lovable app is a blank page? If the console says supabaseUrl is required, the Supabase URL was empty when that site was built.

  5. Rank 5. supabaseUrl is required

    The console says supabaseUrl is required? createClient got an empty URL. Set the project URL the code reads, then rebuild.

  6. Rank 6. Supabase returns an empty array [] but the table has data

    Your Supabase query returns [] with no error even though rows exist? Row Level Security is on with no policy allowing the read.

  7. Rank 7. new row violates row-level security policy for table

    Saving data fails with "new row violates row-level security policy"? Add an INSERT policy with a WITH CHECK rule and send the right user_id.

  8. Rank 8. How to check that Row Level Security is on for every Supabase table

    Need to see which Supabase tables are still open? Security Advisor flags public tables with RLS off. Turn it on, then add a policy.

  9. Rank 9. Supabase Security Advisor warnings explained

    Security Advisor lists security definer views, search_path, or RLS? Here is what the common lints mean and the fix Supabase prints for each.

  10. Rank 10. Webhook signature verification failed. No signatures found matching the expected signature for payload

    Stripe webhook fails signature check? Usually the wrong whsec_ secret or your framework changed the raw request body. Here's the fix.

  11. Rank 11. Stripe webhook failing: 404, 307/308 redirect, timeout or 500

    Stripe shows webhook deliveries Failed with 3xx, 4xx, 5xx or timed out? Point it at the exact final URL and respond 200 fast.

  12. Rank 12. Stripe paid, but the user was not upgraded

    Checkout shows paid and the account stays on the free plan? Upgrade the user from checkout.session.completed, not from the success page.

  13. Rank 13. Vercel Deployment Protection returns 401 and blocks a webhook

    Stripe or another webhook gets 401 from Vercel before your route runs? Deployment Protection is in front of that URL. A production domain stays public under Standard Protection.

  14. Rank 14. Blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present

    "Blocked by CORS policy" on your live site? The server you call must allow your domain. How to fix it for APIs you own and ones you don't.

  15. Rank 15. Supabase Edge Function CORS error: Response to preflight request doesn't pass access control check

    Calling a Supabase Edge Function from the browser fails with a CORS/preflight error? Handle OPTIONS and return corsHeaders on every response.

  16. Rank 16. Supabase Edge Function returns 401 (verify_jwt)

    An Edge Function returns 401 before your code runs? JWT verification is on, and the Authorization header is missing or is not a user JWT.

  17. Rank 17. Vercel 404: NOT_FOUND when refreshing a page or opening a direct link

    Home page works on Vercel but refreshing /dashboard gives 404 NOT_FOUND? Add a rewrite to index.html for your single-page app.

  18. Rank 18. Netlify "Page not found" when refreshing or opening a link

    Netlify shows "Page not found" on refresh or deep links? Add the /* /index.html 200 rewrite so your single-page app handles routing.

  19. Rank 19. Stripe success page 404 on Netlify

    Stripe Checkout returns to your site and Netlify says Page not found? The success URL is a client route. Add the SPA rewrite to index.html.

  20. Rank 20. Module not found: Can't resolve (build works locally, fails on Vercel)

    Vercel build fails with "Module not found: Can't resolve" but works on your Mac/PC? Usually filename casing. How to find and fix it.

  21. Rank 21. Changed an environment variable on Vercel but the live site still uses the old value

    Updated a key in Vercel env vars but nothing changed? Env var changes only apply to new deployments. Redeploy and check the right environment.

  22. Rank 22. Error 400: redirect_uri_mismatch (Sign in with Google)

    Google sign-in shows "Error 400: redirect_uri_mismatch"? The callback URL in Google Cloud must exactly match the one your app or Supabase uses.

  23. Rank 23. Lovable Google sign-in fails on a custom domain

    Sign in with Google works on the Lovable URL and fails on your domain? Add that origin in Google and in Supabase Redirect URLs.

  24. Rank 24. email rate limit exceeded (Supabase Auth)

    Supabase says "email rate limit exceeded" or sign-up emails stop? The built-in mailer allows only 2 emails an hour. Set up custom SMTP.

  25. Rank 25. Supabase confirmation or password reset email not arriving

    Users never get the Supabase confirm or reset email? Check the rate limit, set up custom SMTP and fix the link's Site URL.

  26. Rank 26. Supabase auth emails land in spam

    Confirm and reset emails arrive in spam? The built-in mailer is not for production. Use your own SMTP and set SPF, DKIM, and DMARC.

  27. Rank 27. Supabase service_role or secret key exposed in front-end code

    Is your Supabase service_role or sb_secret key in your browser code? Anyone can read it and bypass all security. How to rotate and fix it.

  28. Rank 28. infinite recursion detected in policy for relation

    Supabase error 42P17 "infinite recursion detected in policy for relation"? Two RLS policies check each other. Break the loop with a function.

  29. Rank 29. permission denied for table (Supabase error 42501)

    Supabase "permission denied for table"? The role lacks a GRANT on the table, which is checked before RLS. Add the grant, then a policy.

  30. Rank 30. Supabase insert works, .select() returns 42501

    The row saves, but .insert().select() returns 42501? Returning the new row needs SELECT. Add the grant and a SELECT policy that matches that row.

  31. Rank 31. Supabase Storage upload fails: new row violates row-level security policy

    Image/file upload to Supabase Storage fails with an RLS error? Add policies on storage.objects for INSERT (plus SELECT/UPDATE for upsert).

  32. Rank 32. Supabase Storage images not loading

    Profile photos or uploads show a broken image? A public URL only works on a public bucket. A private bucket needs a signed URL or the user's JWT.

  33. Rank 33. Vercel FUNCTION_INVOCATION_TIMEOUT (504) on API routes or AI calls

    Vercel API route times out with 504 FUNCTION_INVOCATION_TIMEOUT? Common with slow AI calls. Raise maxDuration, stream, or move work to background.

  34. Rank 34. 500: INTERNAL_SERVER_ERROR / FUNCTION_INVOCATION_FAILED on Vercel

    Live site shows 500 FUNCTION_INVOCATION_FAILED but works locally? Your server code crashed. Read the runtime logs, then check env vars.

  35. Rank 35. too many connections / remaining connection slots are reserved (Supabase + serverless)

    Database errors like "too many connections" after deploying to Vercel? Use Supabase's transaction pooler (port 6543) for serverless functions.

  36. Rank 36. Hydration failed because the server rendered HTML didn't match the client

    Next.js "Hydration failed" error? The server and browser drew different HTML. Fix nesting, window/localStorage use and dates.

  37. Rank 37. Mixed Content: the page was loaded over HTTPS but requested an insecure resource

    Browser blocks requests with a "Mixed Content" warning on your HTTPS site? Change every http:// URL your app calls to https://.

  38. Rank 38. Vercel custom domain shows "Invalid Configuration"

    Added your domain to Vercel and it says Invalid Configuration? Set the DNS records Vercel shows at your registrar and wait for DNS.

  39. Rank 39. Lovable custom domain not working or stuck pending

    Connected your own domain to Lovable and it won't load or stays pending? Check the DNS records Lovable gives you and remove conflicting ones.

  40. Rank 40. Bolt custom domain will not connect

    Bolt will not attach your domain, or the status stays on a DNS warning? Publish first, then use the records Bolt shows. An AAAA record will not connect it.

  41. Rank 41. Bolt publish failed or the live site will not open

    Bolt will not publish, or the bolt.host address says it cannot provide a secure connection? Check the 100MB limit, your network, and a dropped Netlify connection.

  42. Rank 42. Replit deployment fails or published app won't load (server must listen on 0.0.0.0)

    Replit preview works but publishing fails or the URL won't load? Make your server listen on 0.0.0.0, set production Secrets, check ports.

  43. Rank 43. Replit works in the editor but Secrets are missing after publish

    The Replit app runs in the editor and fails once it is published? Production app secrets are a separate list. Set them under Publishing, Adjust settings.

  44. Rank 44. Stripe error: No such price / No such customer (resource_missing)

    Stripe says "No such price" or "No such customer" in production? You're mixing test and live keys or IDs. Match them.

  45. Rank 45. OpenAI API 429: You exceeded your current quota / rate limit reached

    Your app's AI feature fails with OpenAI 429? Either your credits ran out or you're sending requests too fast. How to tell which and fix it.

  46. Rank 46. Anthropic or Gemini API 429 and overloaded errors

    Claude returns 429 or 529, or Gemini returns 429 RESOURCE_EXHAUSTED? Read the error, back off, and keep the API key on the server.

  47. Rank 47. Invalid JWT after switching to sb_publishable or sb_secret keys

    The app broke after Supabase's new sb_publishable or sb_secret keys? Legacy keys can stay on until you swap them. Don't send the new keys as a Bearer JWT.

  48. Rank 48. Build failed: npm ERR! ERESOLVE

    Vercel stops on npm ERR! ERESOLVE unable to resolve dependency tree? npm is refusing a peer dependency clash. Fix the versions, or override the install command on purpose.

  49. Rank 49. ReferenceError: window is not defined

    Next.js crashes with window is not defined? The page is rendered on the server, where window does not exist. Read it after the component mounts.

  50. Rank 50. Supabase error: JWT expired

    API calls fail with JWT expired? The Supabase access token is meant to be short-lived. Refresh the session once, and don't refresh it twice at the same time.

  51. Rank 51. Supabase data loads only after a refresh

    The page is empty until you reload? The first query likely ran before Supabase restored the session. Wait for INITIAL_SESSION, then load the rows.

  52. Rank 52. Clerk sign-in keeps redirecting in a loop

    The app bounces between the page and Clerk sign-in forever? The redirect target is protected too, or the force-redirect URL points back at the gate.

  53. Rank 53. TypeError: Failed to fetch (only in production)

    The live site says Failed to fetch, but the preview worked? The browser could not open the connection. Check the URL, HTTPS, and the console, not the HTTP status.

  54. Rank 54. Vite env var is undefined because the name has no VITE_ prefix

    import.meta.env.MY_KEY is undefined in a Vite app? Vite only exposes names that start with VITE_. Rename it and rebuild.

  55. Rank 55. Lovable GitHub sync is behind, diverged, or created a new repo

    GitHub and Lovable don't match? Lovable syncs one branch, won't reattach an old repo, and replaces its copy if you rewrite history.

  56. Rank 56. Prisma on Vercel: query engine not found

    Vercel runs the app and Prisma can't find its query engine? The Rust engine file was left out of the serverless bundle, or Prisma Client was generated for the wrong machine.

  57. Rank 57. Supabase error: Email address not authorized

    Sign-up tells the user Email address not authorized? The built-in mailer only sends to your Supabase organization. Custom SMTP sends to everyone else.

  58. Rank 58. Stripe secret key (sk_live_, sk_test_, or rk_) is in the front-end code

    A Stripe sk_ or rk_ key shipped in the browser bundle? Only publishable keys belong there. Roll the secret and keep the new one on the server.

  59. Rank 59. OpenAI API key (sk-) is in the front-end code

    An OpenAI sk- key is in the browser bundle? OpenAI says never deploy a key in a browser. Revoke it and call the API from your server.

  60. Rank 60. Anthropic API key (sk-ant-) is in the front-end code

    An Anthropic sk-ant- key shipped in the browser? The Claude docs tell you to keep the key in an environment variable and to proxy browser calls through your server.

  61. Rank 61. AWS access key (AKIA) is in the front-end code

    An AWS access key id starting with AKIA is in the browser bundle? IAM says not to put access keys in application files. Delete that key and use a role instead.

  62. Rank 62. Missing security headers: check HSTS, CSP, X-Frame-Options and nosniff

    A scanner says a security header is not set? Check all four at once: HSTS, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options, then fix each one on your host.

  63. Rank 63. Next.js: a client hook was used in a Server Component

    The build says a component needs useState or useEffect and only works in a Client Component? Next.js wants 'use client' at the top of that file.

  64. Rank 64. Next.js: useSearchParams() is missing a Suspense boundary

    The build says useSearchParams() should be wrapped in a suspense boundary? Without that, Next.js turns the whole page into client rendering and it can stay blank.

  65. Rank 65. Next.js: params, searchParams, or cookies() must be awaited

    The build warns that params, searchParams, cookies(), or headers() was used like a plain object? In Next.js 15 those APIs are async.

  66. Rank 66. Vercel 413 FUNCTION_PAYLOAD_TOO_LARGE

    An upload or a function response dies with 413 FUNCTION_PAYLOAD_TOO_LARGE? Vercel caps a function request or response body at 4.5 MB.

  67. Rank 67. Netlify secret scanning failed the build

    Netlify stopped the deploy because secret scanning found a key in the repo or the build output? Remove that value, then deploy again.

  68. Rank 68. Firestore request failed because security rules denied it

    A Firestore read or write fails after deploy? Firebase says every client request is checked against security rules, and a denied path fails the whole request.

  69. Rank 69. Firebase auth/unauthorized-domain after deploy

    Google sign-in says this domain is not authorized, or the code is auth/unauthorized-domain? The live hostname is missing from Firebase's authorized domains.

  70. Rank 70. Firebase signInWithRedirect fails on the deployed domain

    signInWithRedirect works in a Firebase preview and stalls after you deploy somewhere else? Browsers block the third-party storage that redirect sign-in uses.

  71. Rank 71. Clerk: auth() was called but clerkMiddleware() was not detected

    Clerk says auth() was called but it can't detect clerkMiddleware()? The middleware file is missing, the matcher skipped the request, or a broken asset 404 ran the layout.

  72. Rank 72. Clerk production deploy is still using pk_test_ keys

    The live site still talks to the Clerk development instance? Production keys are pk_live_ and sk_live_, and the host has to be redeployed after you change them.

  73. Rank 73. Supabase signup_disabled: new accounts are turned off

    Sign-up returns signup_disabled? Supabase's general Auth settings include Allow new users to sign up. When that is off, only existing users can sign in.

  74. Rank 74. Supabase PGRST116: .single() did not get exactly one row

    A Supabase query fails with PGRST116 or HTTP 406? .single() asked for one row and the database returned zero or more than one.

  75. Rank 75. Prisma: prepared statement "s0" already exists

    Prisma migrate or a Supabase pooler query says prepared statement s0 already exists? The command is going through PgBouncer. Point Migrate at a direct URL.

  76. Rank 76. Stripe secret_key_required: a publishable key called a secret API

    Stripe returns secret_key_required? The request used a pk_ key. Stripe says that call needs a secret key, and the secret key stays on the server.

  77. Rank 77. Stripe customer portal session will not open

    Manage billing never reaches the Stripe customer portal? Stripe says to configure the portal in the Dashboard, then create the session on the server.

  78. Rank 78. Base44 login not working

    Base44 shows invalid login, a blank reset page, or User.login is not a function? Check App Visibility, the /reset-password path, and the SDK call Base44 documents.

  79. Rank 79. Base44 custom domain or SSL stuck pending

    A Base44 custom domain stays Pending verification, Connecting, or shows ERR_SSL_PROTOCOL_ERROR? Match the DNS records Base44 publishes and remove AAAA records.

  80. Rank 80. Base44 app works for me but not for other users

    Your Base44 app opens for you and fails for everyone else? Base44 says to publish it, set App Visibility, and invite people when the app is Private.

  81. Rank 81. Replit custom domain not working

    A Replit custom domain stays on Verifying or will not load? Copy the A and TXT records Replit shows, keep the replit-verify TXT record, and publish the app.

  82. Rank 82. Replit app works in preview but not when published

    Replit Preview works and publishing fails, or the public URL does not? Check the Publishing logs, production secrets, 0.0.0.0, and the five-second health check.

  83. Rank 83. Replit database empty after publish

    Rows you saved in the Replit editor are missing on the published app? The published app uses a separate production database. Preview keeps using development.

  84. Rank 84. Base44 code export or moving to Vercel

    Export a Base44 app as a ZIP or to GitHub, then run the Vite project on Vercel. Base44 does not export its hosting, auth, or database infrastructure.

  85. Rank 85. Base44 Stripe payments not working

    Base44 checkout does nothing, stays in test mode, or opens a blank page? Publish first, claim the Stripe sandbox, and read the function logs Base44 names.

  86. Rank 86. Gemini API: API key not valid (API_KEY_INVALID)

    Gemini returns 400 API key not valid with reason API_KEY_INVALID? The key is missing, unrestricted, or sitting in the browser. Call Gemini from the server.

  87. Rank 87. Anthropic API 402 billing_error or spend limit reached

    Claude API returns 402 billing_error, or 400/429 after a spend limit? Check payment details and limits in the Claude Console. A 401 is a key problem.

  88. Rank 88. Sign in with Google fails on a custom domain

    Google sign-in works on localhost and fails on the real domain? Add the origin, not a path, to Authorized JavaScript origins, and authorize the live hostname in Supabase or Firebase.

  89. Rank 89. Bolt preview works, the Netlify site does not

    The Bolt preview runs, and the Netlify URL is empty or missing the database? Netlify hosts browser-only sites. A project that needs a database stays on Bolt hosting.

  90. Rank 90. Lovable: Live preview couldn't start

    Lovable's preview is blank or says Live preview couldn't start? Refresh, then Shift+Refresh. A white preview is usually an error in the app, and the preview is not the published site.

  91. Rank 91. Firestore: Missing or insufficient permissions

    Firestore says Missing or insufficient permissions on a read after login? Security rules rejected that operation for the current user and path. A signed-in user can still be denied.

  92. Rank 92. Clerk: Missing or invalid Publishable Key

    Clerk says Missing or invalid Publishable Key on Vercel? Set NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY or VITE_CLERK_PUBLISHABLE_KEY to the pk_live_ key, then redeploy.

  93. Rank 93. Next.js DynamicServerError during the Vercel build

    The Vercel build throws DynamicServerError, or a static page then reads cookies at runtime? Call cookies and headers in the request's async context, or set the route's dynamic export.

  94. Rank 94. Prisma P1001: Can't reach database server

    Prisma on Vercel says P1001 Can't reach database server? That host and port are not accepting a connection. For Supabase, Prisma's serverless URL uses the transaction pooler on port 6543.

  95. Rank 95. Supabase otp_expired: OTP code for this sign-in has expired

    Supabase returns otp_expired on a magic link or email code? That code has expired. Supabase says to sign in again. The default lifetime is 1 hour.

  96. Rank 96. Supabase email_not_confirmed: Signing in is not allowed for this user as the email address is not confirmed

    Sign-in returns email_not_confirmed? Supabase blocks that user until the email is confirmed. Confirm Email lives on the email provider.

  97. Rank 97. Supabase refresh_token_already_used: Refresh token has been revoked and falls outside the refresh token reuse interval

    Supabase returns refresh_token_already_used? That refresh token was already used, outside the reuse interval, and the session was revoked.

  98. Rank 98. Prisma P1000: Authentication failed against database server at {database_host}, the provided database credentials for {database_user} are not valid

    Prisma says P1000 Authentication failed against database server? The user and password in that connection are not valid for the host Prisma printed.

  99. Rank 99. Prisma P2024: Timed out fetching a new connection from the connection pool

    Prisma throws P2024 Timed out fetching a new connection from the connection pool? The pool Prisma is using did not hand out a connection before its timeout.

  100. Rank 100. next/image Un-configured Host

    next/image rejected a src hostname? Next.js says that host is missing from images.remotePatterns, and every part of the URL has to match.

  101. Rank 101. Invalid "use server" Value

    Next.js says Invalid "use server" Value? A file marked "use server" exported something other than an async function.

  102. Rank 102. MIDDLEWARE_INVOCATION_FAILED

    Vercel returns MIDDLEWARE_INVOCATION_FAILED and Internal Server Error? Routing Middleware failed while the CDN invoked it, including from an unhandled exception.

  103. Rank 103. Firebase auth/operation-not-allowed

    Firebase returns auth/operation-not-allowed? That sign-in provider is not enabled. Turn it on in the Firebase console, then save.

  104. Rank 104. Stripe api_key_expired: The API key provided has expired

    Stripe returns api_key_expired? That API key has expired. Stripe says to take the current keys from the Dashboard and update the integration.

  105. Rank 105. Next.js Security Update for Upstream Vulnerabilities

    Is your app on the 14 October 2026 Next.js security update? That post names patched versions 16.4.1 and 15.5.28.

  106. Rank 106. My app won't come back after a restart: is it me or the platform?

    App still down after a restart? Check the host's official status page before changing the project. Two resolved 20-21 Oct 2026 examples.

  107. Rank 107. Failed to find Server Action

    Next.js says Failed to find Server Action? The ID looked valid, but this build has no matching Server Action. The browser may still be on the previous deployment.

  108. Rank 108. Next.js: a Client Component cannot be async

    Next.js says a Client Component cannot be an async function? React Client Components do not support async. Fetch on the server, or drop async and fetch another way.

  109. Rank 109. Vercel INFINITE_LOOP_DETECTED

    Vercel returns INFINITE_LOOP_DETECTED and Loop Detected? The app is requesting itself without stopping, or doing the same to an external API or database.

  110. Rank 110. Vercel MIDDLEWARE_INVOCATION_TIMEOUT

    Vercel returns MIDDLEWARE_INVOCATION_TIMEOUT and Gateway Timeout? Routing Middleware ran past its limit, or sent no response chunk for a while.

  111. Rank 111. Firestore: a compound query does not map to an index

    Firestore rejects a compound query with a range clause? That query does not map to an existing index. The error includes a link that creates the missing index.

  112. Rank 112. Firebase auth/invalid-credential

    signInWithEmailAndPassword returns auth/invalid-credential? With Email Enumeration Protection on, Firebase says the email and password are invalid.

  113. Rank 113. Prisma P2002: Unique constraint failed on the {constraint}

    Prisma says P2002 Unique constraint failed on the {constraint}? That write hit a unique constraint. The message names the constraint.

  114. Rank 114. Supabase PGRST205: the table in the request URI was not found

    The Data API returns PGRST205? Supabase says that HTTP 404 means the table specified in the URI was not found.

  115. Rank 115. Stripe parameter_unknown: the request has unexpected parameters

    Stripe returns parameter_unknown? The request has one or more unexpected parameters. Stripe says to remove them and try again.

  116. Rank 116. Lovable Cloud refuses CREATE EXTENSION

    Lovable refuses CREATE EXTENSION? The October 13, 2026 changelog says Cloud only allows a fixed set of PostgreSQL extensions and builds the rest with plain SQL.

  117. Rank 117. OpenAI API 401: Incorrect API key provided

    OpenAI returns 401 Incorrect API key provided? The key in the request is not correct. It may have a typo, belong to another project, or be deleted.

  118. Rank 118. Claude API 401 authentication_error

    The Claude API returns 401 authentication_error? Anthropic says there is an issue with your API key, for example it is malformed, revoked, or expired.

  119. Rank 119. Supabase Auth invalid_credentials

    Supabase Auth returns invalid_credentials? Supabase's error-code table says the login credentials or grant type were not recognized.

  120. Rank 120. Supabase Auth over_request_rate_limit (429 Too Many Requests)

    Supabase Auth returns over_request_rate_limit or 429? Too many requests came from one IP address. A looping useEffect can cause it.

  121. Rank 121. Prisma P2021: The table {table} does not exist in the current database

    Prisma says P2021 The table does not exist in the current database? The database the app connects to has no table by that name.

  122. Rank 122. Prisma P2025: An operation failed because it depends on one or more records that were required but not found

    Prisma says P2025, records that were required but not found? The operation depends on a record that does not exist. The message gives the cause.

  123. Rank 123. Next.js Prerender Error during next build

    next build fails while prerendering a page? Next.js lists missing props, browser-only APIs, non-page files in pages/, and getStaticProps or getStaticPaths setup.

  124. Rank 124. Next.js: NextRouter was not mounted

    Next.js says NextRouter was not mounted? useRouter from next/router ran outside Next.js, in a test, or in the app directory. Use next/navigation there.

  125. Rank 125. Vercel 404 DEPLOYMENT_NOT_FOUND

    Vercel returns 404 DEPLOYMENT_NOT_FOUND? The request asked for a deployment that does not exist. The URL may be wrong, or the deployment was deleted.

  126. Rank 126. Vercel won't deploy a commit because it can't verify the commit author

    A push to a private repo did not deploy on Vercel? On a Hobby team the commit author must be the team owner. Match the commit email to your account.

  127. Rank 127. Supabase: Database error saving new user

    Sign-up fails with Database error saving new user? Supabase says a trigger, constraint, or permission on auth.users broke. Check the logs, then fix the trigger.

  128. Rank 128. Vercel build error: No Output Directory found (missing public directory)

    Vercel fails after the build with a missing Output Directory error? The folder it serves is missing, empty, or set wrong. Match it to what your build writes.

  129. Rank 129. Next.js: the middleware file convention is deprecated, use proxy

    Next.js warns that the middleware file convention is deprecated? It has been renamed to proxy. Run the official codemod to rename middleware.ts to proxy.ts.

  130. Rank 130. Claude API 400: This model does not support assistant message prefill

    Claude returns 400 invalid_request_error about assistant message prefill? Newer Claude models reject a conversation that ends with an assistant message.

  131. Rank 131. Claude API 400: thinking.type.enabled is not supported for this model

    Claude returns 400 saying thinking.type.enabled is not supported? Newer models removed extended thinking. Use adaptive thinking and output_config.effort.

  132. Rank 132. Supabase Auth flow_state_not_found or flow_state_expired

    Supabase sign-in fails with flow_state_not_found or flow_state_expired? The PKCE login expired or was already used. Start the sign-in again in the same browser.

  133. Rank 133. Next.js: Missing Root Layout tags (html and body)

    Next.js says Missing Root Layout tags? Your app/layout file returns children without the html and body tags. Wrap children in both and rebuild.

  134. Rank 134. Next.js: Using Node.js modules in Edge Runtime (Proxy or Middleware)

    Next.js says your Proxy or Middleware uses a Node.js module in the Edge Runtime? Edge does not support Node.js APIs. Remove the import or use a Web API.

  135. Rank 135. OpenAI API 503: Model temporarily overloaded (server_is_overloaded)

    OpenAI returns 503 server_is_overloaded? The model has no spare capacity right now. Wait for Retry-After, retry with backoff, and check the status page.

  136. Rank 136. Vercel: Lost Git repository access, pushes no longer deploy

    Pushes to GitHub stopped deploying on Vercel? The project lost its Git connection. The repo was archived or deleted, or the Vercel GitHub App lost access to it.

  137. Rank 137. Lovable sign-in works in preview but fails on the published app or custom domain

    Login works in the Lovable preview and breaks on the published app or your own domain? Lovable says the address is usually missing from the auth redirect URLs.

  138. Rank 138. Lovable app users not getting confirmation emails or stuck unconfirmed

    New users of your Lovable app never get the confirmation email, or stay unconfirmed? Check spam, the hourly email limit, and which backend sends the email.

  139. Rank 139. Lovable custom domain stuck on Verifying or Unable to verify

    Your Lovable custom domain sits on Verifying or shows Unable to verify? Lovable can't see its A and TXT records yet. Fix the records, turn off proxying, and recheck.

  140. Rank 140. Lovable custom domain stuck on Setting up, Stalled, or Failed (SSL)

    Your Lovable domain is verified but stuck on Setting up, Stalled, or Failed? The SSL certificate can't be issued. Check CAA records, then click Retry.

  141. Rank 141. Lovable Supabase connection broke: 'Supabase connection issue'

    Lovable shows Supabase connection issue, or won't let you connect your Supabase project? The linked project is gone, paused, or your workspace lost access. Reconnect or disconnect.

  142. Rank 142. Lovable authentication errors: find the right fix

    Lovable app login or sign-up failing? Match what you see to the cause: redirect URLs, confirmation emails, Google sign-in on a custom domain, or sign-up turned off.

  143. Rank 143. Content Security Policy (CSP) header not set, or missing CSP directives

    A scanner says Content Security Policy (CSP) header not set, or lists missing CSP directives? Send a Content-Security-Policy response header and set the directives default-src doesn't cover.

  144. Rank 144. X-Frame-Options header not set

    A scanner says X-Frame-Options header not set? Other sites can put your page in a frame. Send X-Frame-Options: DENY or SAMEORIGIN as a response header, or use CSP frame-ancestors.

  145. Rank 145. X-Content-Type-Options header missing

    A scanner says X-Content-Type-Options header missing? Add X-Content-Type-Options: nosniff as a response header, and make sure scripts and stylesheets are served with the right Content-Type.

  146. Rank 146. CORS: Content-Type application/json is not safelisted and triggers a preflight

    Your cross-origin request with Content-Type: application/json fails CORS? That value isn't CORS-safelisted, so the browser sends a preflight OPTIONS request your server must answer.

  147. Rank 147. Cloudflare invalid SSL certificate (Error 526) on a custom domain

    Your custom domain shows Cloudflare Error 526: invalid SSL certificate? Cloudflare is on Full (strict) and can't validate the certificate on the host behind it.

  148. Rank 148. Vibe-coded site not indexed by Google: how to fix it

    Your Lovable, Bolt, or other vibe-coded site doesn't show up in Google? Make sure Google can reach, crawl, and render it, then submit a sitemap in Search Console.

  149. Rank 149. Lovable export code won't run locally or on another host

    Code you exported or synced from Lovable won't run on your computer or another host? Check which stack it uses, install with the right lockfile, and set the variables Lovable supplied.

  150. Rank 150. Lovable app not deploying or not working after publish

    Your Lovable app won't publish, or the live site doesn't show your changes? The Publish dialog says why. Use its Try again or Try to fix action, or fix the blocked setting.

Check a live URL for leaked keys

Paste a public address. The check reads the HTML and that site's own scripts, then flags server keys and three missing security headers. The URL and the results are not saved.

Open leak check

Self-serve products

A deep leak report is $15 after the free scan. Fix packs are $24 each, or $49 for all three. There is no done-for-you repair.

Supabase Launch Safety Pack · Stripe Payments That Work Pack · Deploy Without Errors Pack · All Packs Bundle

Compare the packs

Comparisons

No failure-rate scores. These pages compare what Lovable, Bolt, Cursor, Supabase, Firebase, Vercel, and Netlify document.

Shipping an AI-built app this week?

Checklists and prompts for Supabase security, Stripe payments and deploys.

One-time payment through Stripe, no subscription. Download after payment. Purchase questions go through the help form.