Notes for shipping AI-built apps

Before you launch an AI-built app, verify the systems behind the demo: authentication, data access, payments, deployment, monitoring, and recovery. This overview explains what readiness means and when to move to a detailed launch checklist.

VercelChecklist

When Vercel environment variables are not working in production, a variable that works locally but is undefined on Vercel is usually missing from the Production environment, read under a different name, or newer than the deployment: Vercel applies variable changes to new deployments only. Check the name, the environment, build time vs runtime, redeploy, then test the result.

SupabaseLovableResearch

We read the policies an AI app builder ships with, not the live databases. One in six public Lovable projects lets anyone change or delete a whole table, often under a policy name that says otherwise.

SupabaseLovableResearch

Nearly half of the Lovable projects we read ship a Postgres function that skips RLS and that anyone with the public anon key can call. We read the functions in 18 of them to see what a signed-out caller could actually do.

SupabaseLovableResearch

29 of 512 public Lovable repos (5.7%), each read at its last commit before October 3, 2026, commit a Supabase service role or secret key, the key that skips RLS. The key is rarely in the app itself. It sits in a one-off script, a deploy guide, or the .env.example that was meant to hold placeholders.