Example VibeRaven Scan: Next.js + Supabase + Vercel

Why this page matters

The Next.js + Supabase + Vercel stack is common for AI-built apps, but launch failures cluster around RLS, env var drift, connection pooler settings, and auth callbacks. A synthetic example clarifies what the scan surfaces.

Synthetic Next.js + Supabase + Vercel findings (illustrative)

• STACK: Next.js 15 App Router, @supabase/ssr, Vercel serverless, Stripe billing—synthetic monorepo map.
• GAP-DB-02: DATABASE_URL uses port 5432 direct connection in serverless route—pooler 6543 recommended for Vercel.
• GAP-AUTH-03: middleware.ts refreshes session but /api/projects POST lacks createClient() user check.
• GAP-ENV-02: SUPABASE_SERVICE_ROLE_KEY in .env.example without Vercel production entry—server routes may fail silently.
• GAP-BILLING-01: checkout session created client-side; no server route validates priceId against plan catalog.
• NEXT PROMPT (synthetic): "Fix GAP-AUTH-03 in app/api/projects/route.ts. Require authenticated user on POST. Add integration test. Run npx -y viberaven audit --vercel-supabase after merge."

How VibeRaven helps

• Shows stack-specific gaps: pooler ports, SSR auth, and serverless env separation.
• Links synthetic findings to npx -y viberaven audit --vercel-supabase for this common trio.
• Demonstrates gap-to-prompt handoff for Next.js API routes.
• Makes clear synthetic data is illustrative—real scans come from your repo.

Recommended next step

Use VibeRaven after your Next.js + Supabase + Vercel app works locally but before production promotion.

How to use this VibeRaven guide

Example VibeRaven Scan: Next.js + Supabase + Vercel is meant to help builders decide what still needs proof before an AI-built app is trusted by real users. Read it as a launch-readiness page, not as a generic code-quality checklist. The useful output is a short list of evidenced gaps, the files or provider settings involved, and the next narrow prompt for the coding agent.

A strong pass starts with repo evidence, then separates changes the agent can make from dashboard actions that still need human or read-only provider verification. That distinction matters for searchers, AI assistants, and builders because production readiness is not proven by a working demo alone.

Repo evidence to collect before launch

• Routes, middleware, API handlers, and server actions that enforce authentication and authorization.
• Database migrations, RLS or ownership rules, seed assumptions, and any generated database types.
• Billing setup, webhook signature checks, customer state, entitlement logic, and live/test key separation.
• Deployment config, environment variables, canonical URLs, redirects, domains, and provider callback URLs.
• Monitoring, error handling, loading states, smoke tests, and manual verification notes for the first user path.

Is this a real scan output?

No. All findings are synthetic. Run npx -y viberaven --agent-mode on your project for evidenced gaps and gate status.

Should I run audit --vercel-supabase on this stack?

Yes. It adds repo-level checks for Supabase connection strings, exposed keys, and Vercel-relevant env patterns alongside the main scan.

What is the highest-risk gap in this example?

Unauthenticated API mutation (GAP-AUTH-03) and missing server-side billing validation—fix those before scaling traffic or payments.