Guides for shipping AI-built apps

SupabaseFree tool

Paste Supabase migrations or .sql files to find tables without RLS, using (true) policies and security definer functions anon can call. Runs in your browser.

Exact Supabase, Vercel, Next.js and Stripe error messages with fixes: new row violates row-level security policy, FUNCTION_INVOCATION_FAILED, JWT expired.

SupabaseError index

Exact Supabase error messages with their causes and fixes: new row violates row-level security policy, JWT expired, Invalid API key, email rate limit exceeded.

VercelError index

Exact Vercel error messages and their fixes: FUNCTION_INVOCATION_FAILED, FUNCTION_INVOCATION_TIMEOUT, DEPLOYMENT_NOT_FOUND, MIDDLEWARE_INVOCATION_FAILED.

Exact Next.js error messages and fixes: useSearchParams() should be wrapped in a suspense boundary, Failed to collect page data, Failed to find Server Action.

StripeError index

Exact Stripe errors and fixes: No signatures found matching the expected signature for payload, No such price, Neither apiKey nor config.authenticator provided.

ClerkError index

Exact Clerk errors with fixes: @clerk/nextjs keys missing, Clerk can't detect usage of clerkMiddleware, Production Keys are only allowed for domain.

ResendError index

Exact Resend errors with fixes: You can only send testing emails to your own email address, Missing API key, No matching signature found.

Auth.jsError index

Exact Auth.js and NextAuth error messages with their fixes: [auth][error] UntrustedHost, [auth][error] MissingSecret and [next-auth][error][NO_SECRET].

TursoError index

Exact Turso and libSQL errors with fixes: SERVER_ERROR HTTP status 401, URL_INVALID for an undefined URL, and drizzle-kit missing turso dialect params.

Auth0Error index

Exact Auth0 errors in Next.js on Vercel with fixes: Callback URL mismatch, Not all required options were provided, The state parameter is invalid.

MongoDBError index

Exact MongoDB and Mongoose errors on Vercel with fixes: MongoServerSelectionError, MongoParseError invalid scheme, MongooseError buffering timed out.

PlanetScaleError index

Exact PlanetScale errors with fixes: Prisma P3022 direct DDL is disabled, Prisma P3021 foreign keys cannot be created, TypeError: fetch failed.

Better AuthError index

Exact Better Auth errors with fixes: Invalid origin, You are using the default secret, Database schema mismatch with missing tables.

TursoGuide

Turso answers HTTP 401 when the auth token is missing, wrong or expired. Create a new token with the Turso CLI, set TURSO_AUTH_TOKEN in Vercel, redeploy.

TursoGuide

createClient got undefined as its url because TURSO_DATABASE_URL has no value where the code runs. Set it in Vercel for each environment and redeploy.

TursoGuide

drizzle-kit migrate prints url: undefined when TURSO_DATABASE_URL is not in the environment it runs in. It reads .env, not Next.js .env.local.

VercelAuth0Guide

Auth0 rejects a redirect_uri that is not an exact entry in Allowed Callback URLs. In nextjs-auth0 v4 it comes from APP_BASE_URL or the request host.

Auth0Guide

nextjs-auth0 v4 logs this when AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_SECRET or a client secret is missing. Set them in Vercel per environment and redeploy.

VercelAuth0Guide

nextjs-auth0 v4 returns 500 "The state parameter is invalid." when no __txn_ cookie matches the callback. Use one origin and one secret.

UpstashGuide

Redis.fromEnv() only warns when the Upstash URL or token is missing, then the first command fails. Set both in Vercel for each environment and redeploy.

UpstashGuide

Upstash rejects a REST request when the token is missing or wrong. Use the REST token, not the TCP password, check which variable wins, then redeploy.

VercelUpstashGuide

Add @upstash/ratelimit to a Next.js route handler on Vercel: slidingWindow, the IP from x-forwarded-for, a 429 before the paid call, and the env vars.

VercelMongoDBGuide

Server selection timed out on Vercel usually means the Atlas IP access list blocks Vercel's dynamic IPs. Allow 0.0.0.0/0 or use Static IPs.

VercelMongoDBGuide

MongoParseError Invalid scheme means MONGODB_URI does not start with mongodb:// or mongodb+srv://. Fix an empty or quoted value on Vercel, redeploy.

VercelMongoDBGuide

Mongoose buffering timed out means a query ran before the connection was ready. On Vercel, await a cached connection and read the real connect error.

PlanetScaleGuide

Prisma P3022 on PlanetScale: DDL sent straight to a branch with safe migrations on is rejected. Push to a dev branch, then deploy a deploy request.

PlanetScaleGuide

Prisma P3021 on PlanetScale: the database has foreign key constraints off. Set relationMode = "prisma" and add indexes, or enable foreign keys in settings.

VercelPlanetScaleGuide

The PlanetScale serverless driver throws "fetch failed ... ENOTFOUND undefined" when DATABASE_URL is empty at runtime. Add it in Vercel and redeploy.

RenderGuide

Render fails a deploy with "Port scan timeout reached" when nothing listens on 0.0.0.0 and the PORT value. Bind there, keep start simple, redeploy.

SupabaseRenderGuide

connect ENETUNREACH from Render to db.<ref>.supabase.co: the direct host is IPv6 and Render has no outbound IPv6. Use the shared pooler on 5432 or 6543.

RenderGuide

Vite copies VITE_ values into the bundle during the build. On Render, set them before the build and rebuild after a change; Save only does not rebuild.

CloudflareGuide

A Worker has no global process unless nodejs_compat is on. Read secrets from env or context.env, or set nodejs_compat with a date of 2025-04-01 or later.

CloudflareGuide

A Worker or Pages Function imports a Node.js module without nodejs_compat. Add the flag with a compatibility_date of 2024-09-23 or later, then redeploy.

CloudflareGuide

A Worker reused a stream, Response or database connection from an earlier request. Create the Postgres or Supabase client inside the handler, per request.

NetlifyGuide

Netlify shows "Page not found" on refresh when a single-page app has no rewrite to index.html. Add /* /index.html 200 to a _redirects file in public/.

NetlifyGuide

A Netlify function reads undefined when the variable lacks the Functions scope, sits only in netlify.toml, or was set after the last deploy. Fix and check.

NetlifyGuide

Vite bakes VITE_ values into the bundle at build time, and Netlify does not read .env files. Add them in Environment variables, then redeploy.

A browser PUT to a presigned S3 URL fails with No Access-Control-Allow-Origin when the bucket CORS rule is missing or lacks your origin. Add the rule.

S3 answers 403 SignatureDoesNotMatch when the PUT differs from what the presigned URL signed. Check keys, signed headers, checksum, clock and region.

The AWS SDK v3 found no credentials. On Vercel, add AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY for each environment, or pass credentials to S3Client.

GitHubGuide

GitHub push protection blocked your push with GH013. Remove the secret from every commit it appears in, or bypass from the URL GitHub prints.

GitHubGuide

Rotate the key with its provider first, update Vercel and redeploy. GitHub says history cleanup is optional once the credential is revoked.

GitHubGuide

GitHub does not pass Actions secrets to runs from forks, and Dependabot runs only get Dependabot secrets. An unset secret is an empty string.

ResendGuide

Resend returns 403 validation_error when onboarding@resend.dev sends to anyone but your own account email. Verify a domain and change the from address.

ResendGuide

The resend SDK throws this when RESEND_API_KEY is empty where new Resend() runs. On Vercel it often fails the build as "Failed to collect page data".

ResendGuide

A Resend domain stuck pending usually has records at the wrong DNS host, a proxied or conflicting CNAME, or a changed value. Checks and nslookup commands.

Better AuthGuide

Better Auth throws this in production when no secret is set. Add BETTER_AUTH_SECRET in Vercel for Production and Preview, then redeploy.

VercelBetter AuthGuide

Better Auth builds the OAuth redirect_uri from baseURL. Set BETTER_AUTH_URL to your production origin in Vercel and register the callback URL.

Better AuthGuide

Better Auth logs Missing tables when production never got its schema. Run npx auth migrate, or generate and apply the migration for Drizzle or Prisma.

NeonGuide

neon() got undefined, usually a missing DATABASE_URL. Add it in Vercel for the failing environment and redeploy. Driver 1.2.0 words the error differently.

NeonGuide

Prisma P1002 on Neon: migrate waited 10 seconds for its advisory lock. Run migrations on the direct string (no -pooler); keep the pooled one for the app.

NeonGuide

Prisma P1001 on Neon usually means the compute was asleep and the connection timed out first. Raise connect_timeout, check the host, then redeploy.

VercelFirebaseGuide

getAuth() throws auth/invalid-api-key when apiKey is undefined, empty or has a colon. On Vercel, the NEXT_PUBLIC_ or VITE_ variable was missing at build.

FirebaseGuide

Firestore denied a client request under your Security Rules (code permission-denied). Check sign-in timing, the published rules and the query shape.

VercelFirebaseGuide

firebase-admin found no Application Default Credentials. Vercel has none, so pass cert() with service account values from server-side variables.

VercelPostHogGuide

posthog-node queues events and sends them later, but a Vercel function can freeze after it returns. Await flush(), shutdown() or captureImmediate().

VercelPostHogGuide

Proxy PostHog through your own domain with Next.js rewrites. Without skipTrailingSlashRedirect every request gets a 308. Order the rewrites, set ui_host.

PostHogGuide

getFeatureFlag() is undefined until the flags request finishes, so new visitors see the wrong branch. Use onFeatureFlags, a hook default or bootstrap.

VercelSentryGuide

No server errors in Sentry from Next.js often means instrumentation.ts is in the wrong folder or lacks onRequestError. What each hides, and the fix.

SentryGuide

net::ERR_BLOCKED_BY_CLIENT means the visitor's browser blocked the Sentry request. In Next.js, tunnelRoute sends events through your own domain.

SentryGuide

The Sentry Vite plugin skips the source map upload when authToken is empty, and the build still passes. Set SENTRY_AUTH_TOKEN in Vercel and redeploy.

ClerkGuide

auth() throws this in @clerk/nextjs when clerkMiddleware() did not run for the request. Check the proxy.ts or middleware.ts name, folder and matcher.

ClerkGuide

The @clerk/backend redirect loop log means the Clerk keys do not match, or the host is not one the instance knows. Re-copy both keys and check the host.

ClerkGuide

clerk-js throws this when a pk_live key runs on localhost or a Vercel preview URL. Use development keys there and keep live keys on Production only.

PaddleGuide

A test_ client-side token needs the sandbox environment and a live_ token must not set it. Pass environment to initializePaddle, then redeploy.

PaddleComparison

Paddle's provisioning guide grants access on subscription.created and rereads status on subscription.updated. transaction.completed fits one-off charges.

PolarGuide

Polar sandbox and production tokens are separate. @polar-sh/sdk 1.x reads environment, not server, so a call can reach api.polar.sh with a sandbox token.

Playwright cannot find the browser build for the version you installed. Run npx playwright install --with-deps before the tests in your CI job.

VercelPlaywrightGuide

Send x-vercel-protection-bypass from Playwright extraHTTPHeaders, with the Protection Bypass for Automation secret stored in GitHub Actions.

Playwright waited 60000 ms for your webServer url and got no ready answer. Match url to the server port, make the page answer, then rerun.

CloudflareGuide

Turnstile siteverify returns timeout-or-duplicate when a token is validated twice, invalid-input-response when expired. Verify once per submit in Next.js.

SupabaseGuide

Supabase Auth returns captcha_failed when CAPTCHA protection is on and the request has no token. Pass options.captchaToken on sign up, sign in and reset.

VercelGuide

checkBotId() logs this when the request lacks BotID headers. Add the path and method to initBotId protect, send with fetch, and test on a Vercel Preview.

SvelteKitGuide

SvelteKit stops the build when code that reaches the browser imports a private env module. Read the variable in a server-only file and pass the result on.

SupabaseSvelteKitGuide

A SvelteKit build fails when an imported $env/static/private variable is not set while it builds. Add it in Vercel for that environment and redeploy.

SvelteKitGuide

SvelteKit answers 403 when a form POST comes from another origin or has no Origin header. Trust the sender with csrf.trustedOrigins, or fix the origin.

NuxtGuide

A Nuxt runtimeConfig value stays empty in production when the env var is not named NUXT_ plus the key path, or the key is missing from nuxt.config.

SupabaseNuxtGuide

@nuxtjs/supabase warns Missing NUXT_PUBLIC_SUPABASE_URL when Nuxt loads it with no URL. Set NUXT_PUBLIC_SUPABASE_URL and _KEY in Vercel and redeploy.

NuxtGuide

Vue logs this when the Nuxt server HTML differs from the browser. A date in another time zone is a common cause after deploy; NuxtTime fixes it.

VercelAngularGuide

An Angular app on Vercel shows 404: NOT_FOUND when the Output Directory is not dist/my-app/browser. Clear the override or set outputDirectory.

VercelAngularGuide

Angular has no process.env in the browser bundle. Write the Vercel variable into environment.ts with a Node script before ng build, then redeploy.

AngularGuide

Angular NG0507 means the nghm comment was missing when hydration started. A CDN or build step removed comments from the SSR HTML. Turn that off.

VitestGuide

Vitest loads only VITE_ names from .env files, and an uncommitted .env is missing in CI. Use loadEnv with test.env, or set env in the workflow.

VitestGuide

Vitest runs tests in Node, where document and window do not exist. Set test.environment to jsdom or happy-dom, install it, or add a file comment.

VitestGuide

Vitest does not read tsconfig paths unless told to. Add resolve.alias with an absolute path, vite-tsconfig-paths, or resolve.tsconfigPaths.

VercelFastAPIGuide

Vercel fails a FastAPI build with "No FastAPI entrypoint found" when no known file defines app. Rename the variable or set tool.vercel.entrypoint.

SupabaseVercelFastAPIGuide

ModuleNotFoundError on a Vercel FastAPI app means the package is missing from the dependency file Vercel found, next to your entrypoint or above it.

VercelFastAPIGuide

A CORS error from a Vite app to FastAPI on Vercel means no Access-Control-Allow-Origin header came back. Check the origins, the preflight and any 500.

RailsGuide

Rails boots in production only with a secret_key_base. On Render, Railway, Fly.io or Heroku, set RAILS_MASTER_KEY or SECRET_KEY_BASE, then deploy again.

RailsGuide

Rails answers 403 and logs "Blocked hosts" when config.hosts lacks the request host. Add the custom domain and the platform hostname, then deploy again.

SupabaseRailsGuide

Rails raises PG::DuplicatePstatement on Supabase port 6543: transaction mode has no prepared statements. Set prepared_statements: false or use port 5432.

VercelGoGuide

Vercel builds every .go file in api/ as a function and needs one exported func with http.ResponseWriter and *http.Request. Move helpers out of api/.

SupabaseGoGuide

pgx caches named prepared statements, which the Supabase pooler on port 6543 does not support. Add default_query_exec_mode=exec to the URL, or use 5432.

SupabaseGoGuide

golang-jwt rejects a Supabase token when WithValidMethods lists only HS256 but the project signs with ES256. Verify against the JWKS endpoint instead.

ReactGuide

Minified React error #185 is Maximum update depth exceeded in a production build. Find the layout effect, ref callback or store that loops, then fix it.

ReactGuide

Minified React error #418 means the HTML React hydrated did not match the first client render. Find the window, Math.random, date or nesting mismatch.

ReactGuide

React Router throws this when a hook runs outside a router or against a second copy of the package. In v6 production builds the message is empty.

VercelLogRocketGuide

LogRocket records only where LogRocket.init runs in the browser with your app ID. Check dashboard limits, client-only init and the build-time env var.

LogRocketGuide

The logrocket package prints this warning when its logger script fails to load. Allow LogRocket in your CSP, test without extensions, or proxy it.

LogRocketGuide

LogRocket skips password inputs but records other fields and network calls by default. Use data-private, DOM sanitizers and network sanitizers.

StorybookGuide

Storybook passes only STORYBOOK_ and VITE_ names (NEXT_PUBLIC_ with nextjs-vite) to stories. Rename the variable and set it where Storybook builds.

StorybookGuide

useRouter from next/navigation throws this when a story has no App Router context. Set nextjs.appDirectory to true in Storybook preview, or per story.

VercelStorybookGuide

A Storybook deploy on Vercel shows 404 NOT_FOUND when the project builds the app, not Storybook, or the output directory is not storybook-static. Fix it.

SupabaseGuide

Grep the repo for SUPABASE_SERVICE_ROLE_KEY, sb_secret_ keys and public-prefixed names in browser files, then grep the built bundle for the key value.

Yes. Vite copies every VITE_ value into the browser bundle at build time. List the VITE_ names your repo uses and move any secret to a server function.

VercelGuide

List the names your code reads with git grep, compare them with vercel env ls production, and redeploy after adding one. Deno.env names live in Supabase.

SupabaseGuide

Review Supabase anon read access with table and column grants, RLS and policies. A SQL query narrows the review; test the actual columns and role too.

SupabaseGuide

Find every .from().select() with no .limit(), .range() or .single(). Supabase caps a response at 1,000 rows by default, which hides the problem.

List your route handlers and server actions, mark the ones that cost money, and find a limit in front of each: a Vercel WAF rule or a limiter in the code.

Check the live response with curl -sI, then find where the repo sets it: headers() in next.config, proxy.ts (middleware.ts before Next.js 16) or vercel.json.

git ls-files shows the env files git tracks, git log --all every commit that touched one. If you find one, rotate the keys first, then untrack the file.

SupabaseGuide

supabase migration list --linked compares migration timestamps and supabase db diff --linked the schema. A non-empty diff means live changes the repo lacks.

You vibe coded an app and it works. The steps to real users: secrets, RLS, auth, payments, env vars, monitoring, backups, domain and email, legal, launch day.

Secure a vibe-coded Vercel + Supabase app in order of risk: RLS on every table, secret keys off the client, signed webhooks, locked-down functions. With SQL.

SupabaseVercelGuide

Deploy a vibe-coded app to Vercel + Supabase: env vars per environment, preview vs production, migrations, Stripe live keys and webhooks, a custom domain.

Vibe coding can ship production apps, but its gaps are predictable: open RLS, secret keys in the client, unsigned webhooks. What the evidence shows.

The concrete security risks in vibe-coded apps: open RLS, keys in client bundles, unsigned webhooks, security definer functions, .env in git, no rate limits.

Documented vibe coding incidents from 2025 and 2026: open Supabase databases, deleted production data, an auth bypass. What happened, the root cause, the fix.

Claude CodeComparison

What Anthropic's Claude Code Security, /security-review and Code Review do, from Anthropic's docs, and how a Vercel + Supabase pre-deploy review differs.

SupabaseGuide

Yes. The anon and publishable keys are public by design; RLS and grants decide what they reach. npx -y viberaven check finds tables without RLS.

SupabaseGuide

Supabase anon key: Settings > API Keys in the dashboard, the long key starting eyJ. Its replacement, the publishable key (sb_publishable_), is also in Connect.

SupabaseGuide

Find SUPABASE_SERVICE_ROLE_KEY in Settings > API Keys (eyJ, or sb_secret_). In a public .env, a repo or a NEXT_PUBLIC_ variable? Treat it as leaked.

SupabaseGuide

Empty rows mean the request ran as anon (auth.uid() is null) or no policy matched; 42501 is a missing grant; the service_role key skips RLS. Fix per symptom.

SupabaseGuide

A Supabase select that returns [] and error null usually means row level security hid every row: RLS on with no SELECT policy, or no user session.

SupabaseGuide

PGRST116 "Cannot coerce the result to a single JSON object" means .single() got 0 rows or more than 1. Use .maybeSingle(), or fix the filter or RLS policy.

SupabaseGuide

SUBSCRIBED but no updates? Trace Supabase Postgres Changes through publication, user access, filters and UI state, with a diagnostic probe and test worksheet.

SupabaseGuide

Test Supabase RLS with a pgTAP file per table: switch to anon and authenticated, set the user id, and assert what each can read, insert, update and delete.

SupabaseComparison

USING filters which existing rows a command can see or change; WITH CHECK decides which new rows may be written. Which commands take which, with examples.

SupabaseGuide

using (true) makes a Supabase RLS policy match every row for its roles: fine for public reads, wrong on update, delete or all. How to find and replace them.

SupabaseGuide

A service role key in a browser bundle, a NEXT_PUBLIC_ or VITE_ variable or git is leaked. Fix the leak, move servers to a new secret key, then retire the old.

SupabaseGuide

Check a .env in a public repo, /.env on your domain, NEXT_PUBLIC_ or VITE_ in the bundle, and GitHub alerts. If the key is out, rotate it and redeploy.

SupabaseGuide

The publishable key (sb_publishable_) replaces the anon key and the secret key (sb_secret_) replaces service_role. Same roles, same RLS. Legacy keys go in 2026.

SupabaseGuide

Yes, with RLS on every exposed table, policies that check the caller and the secret key kept on your server. The Supabase platform is SOC 2 Type 2 compliant.

SupabaseGuide

What rls_disabled_in_public, security_definer_view, function_search_path_mutable and other Supabase Security Advisor warnings mean, and the fix for each.

SupabaseGuide

rls_disabled_in_public: a public Supabase table with row level security off. Enable RLS, add policies. npx -y viberaven check finds them in migrations.

SupabaseGuide

security_definer_view is a Supabase Security Advisor error: a view that runs as its owner and skips RLS. Set security_invoker = true, then check the fix.

SupabaseGuide

function_search_path_mutable is a Supabase Security Advisor warning: a function with no fixed search_path. Set it to empty, qualify names, then check.

SupabaseGuide

rls_enabled_no_policy is a Supabase Security Advisor notice: RLS is on but the table has no policy, so API reads come back empty. Add policies, then check.

SupabaseGuide

permissive_rls_policy, reported as rls_policy_always_true, is a Supabase Advisor warning for a policy with check (true) or using (true) on writes. The fix.

SupabaseGuide

sensitive_columns_exposed is a Supabase Security Advisor error: an API table with RLS off and a column like password, token or ssn. Enable RLS, then check.

SupabaseGuide

auth_rls_initplan is a Supabase Performance Advisor warning, not a security one: auth.uid() runs once per row. Wrap it in select, then check the fix.

SupabaseGuide

authenticated_security_definer_function_executable: any signed-in user can call a security definer function that skips RLS. Revoke it from authenticated.

SupabaseGuide

Lint 0028: anon can call it at /rest/v1/rpc, and one owned by postgres skips RLS. Revoke EXECUTE, set search_path. Find them: npx -y viberaven check.

SupabaseGuide

Since October 30, 2026 new public tables on existing Supabase projects get no Data API grant and return 42501. Grant them; npx -y viberaven changes lists them.

SupabaseGuide

Supabase "permission denied for table" (42501): the anon or authenticated role has no grant. Not an RLS policy. Fix: grant select on the table to that role.

SupabaseGuide

Supabase Auth returns email rate limit exceeded (429) after 2 emails an hour on the built-in provider. Set up custom SMTP, then raise the limit in Rate Limits.

SupabaseGuide

Supabase sends 2 auth emails an hour on its built-in provider, only to your team. Add custom SMTP, or turn off Confirm email, and fix where the link lands.

SupabaseGuide

Supabase sends users to the Site URL, often localhost:3000, when redirectTo is not in the Redirect URLs list. Set the Site URL and allow your production URL.

SupabaseGuide

Storage uploads need an INSERT policy on storage.objects, and upsert also needs SELECT and UPDATE. Never alter storage.objects: RLS is already on.

SupabaseGuide

Supabase "new row violates row-level security policy" (42501): no INSERT or UPDATE policy passed the row. Add one with WITH CHECK, and SELECT for .select().

SupabaseGuide

Supabase "Invalid API key" (401): the apikey header holds a key this project does not accept, such as one from another project. Copy both from one project.

SupabaseGuide

Supabase 401 "No API key found in request": the request reached the API gateway with no apikey header. Send the publishable key, set the env var, redeploy.

SupabaseGuide

Supabase AuthSessionMissingError: getUser() or updateUser() ran on a client with no session: a signed-out visitor, or server code without the auth cookies.

SupabaseGuide

Supabase "Edge Function returned a non-2xx status code" hides the real error: read error.context for the status and body, then fix the function or its secrets.

SupabaseGuide

supabase-js throws FunctionsFetchError when the request never got a response: a wrong project URL, a function not deployed, CORS, or a timeout.

SupabaseGuide

Postgres raises 42P17 when an RLS policy queries its own table, often an admin check on profiles. Move the check into a security definer function.

SupabaseGuide

Postgres 42501 for a schema means the API roles lost USAGE on it. Grant usage on schema public to anon, authenticated and service_role, then the tables.

SupabaseGuide

PGRST205 means the Supabase API has no table by that name: a typo, a migration not applied to this project, or a stale cache. Check, then reload the schema.

SupabaseGuide

Supabase returns 401 JWT expired when a request carries an access token past its exp, often one copied into a header or cookie and never refreshed.

SupabaseGuide

Supabase returns 500 "Error sending confirmation email" when the SMTP server refuses the message. With Resend, check the API key, sender domain and port.

SupabaseRailwayGuide

connect ENETUNREACH from Railway to db.<ref>.supabase.co: the direct host is IPv6 only and Railway egress is IPv4 by default. Use the session pooler on 5432.

SupabaseCloudflareGuide

Each supabase-js call in a Worker is a subrequest: 50 per request on Free, 10,000 on Paid. Replace per-row queries with in() or an embed, or raise the limit.

SupabaseNetlifyGuide

Netlify fails the build when a variable marked secret, such as VITE_SUPABASE_ANON_KEY, is in the bundle. Omit public keys only; the service key must fail.

SupabaseGuide

Find tables missing RLS in ordered public-schema migrations, with reproducible SQL examples and a pg_tables query. Confirm production with the Security Advisor.

SupabaseComparison

A repo scan reads what your migrations and code say. Applied migrations, live grants, dashboard settings and how policies treat real users need the database.

SupabaseGuide

What is RLS on Supabase for AI-built apps: row-level security basics, policies, service-role risk, and how to verify database access before launch.

SupabaseChecklist

Check Supabase auth, RLS policies, service-role key usage, storage access, migrations, and production data boundaries before launching an AI-built app.

SupabaseClerkGuide

Clerk + Supabase in 2026: native third-party auth, Clerk's token as accessToken, RLS on auth.jwt() sub, and since Oct 30 a grant to authenticated, or 42501.

SupabaseChecklist

Launch your Supabase app with checks for migrations, login, RLS, Storage and Edge Functions. Know what should pass, what to fix and what needs a live test.

SupabaseGuide

OrioleDB is in public beta on every Supabase plan since October 28, 2026. You pick it when you create a project. The limits, and what happens to RLS and grants.

SupabaseGuide

Supabase Compute runs agents, jobs and APIs next to your database, from Node, Deno or a Dockerfile. Private alpha since October 27, 2026, us-west-2 only.

SupabaseClaude CodeGuide

Supabase's MCP Server block puts an MCP server in an Edge Function. Users sign in with OAuth 2.1, each tool call runs as them, and RLS decides what it reads.

SupabaseGuide

Supabase CLI v2.119.0 runs one local project per git worktree on its own ports, and a native runtime with no Docker. Turn on stack, drop the fixed ports.

SupabaseGuide

Supabase Dashboard tokens are scoped by default: projects, Read or Read-write per resource, an expiry. What an agent needs, the 403, and the CLI.

SupabaseLovableChecklist

What to check first before a Lovable + Supabase app goes live: RLS on every public table, which key ships to the browser, a two-account test and auth URLs.

SupabaseBoltGuide

Move a Bolt app to your own Supabase: claim its Bolt Database (Pro or Teams) to transfer the Supabase project. Connect swaps the database. Files need a script.

Before handing an AI-built Vercel + Supabase app to a client: transfer the projects, rotate keys, list env vars, check Stripe live mode, auth URLs and backups.

An AI app readiness check covers what a demo cannot show: RLS, secret keys, env vars, auth URLs, webhooks, storage, backups, errors and rollback.

AI app production-ready checklist: auth, billing, database, deploy, monitoring and test gaps before launch, and what a repo check covers on Vercel + Supabase.

LovableChecklist

Recheck the published Lovable URL, not the preview: sign-in on your domain, data that survives a reload, private rows, no secret keys in frontend, live Stripe.

LovableGuide

Test a Lovable app in 4 steps: browser testing on the preview, private rows checked with two accounts, the Quick and Deep scans, then retest the published URL.

LovableGuide

What Lovable shows after you publish (Analytics, Logs, Usage, Project monitoring), what Supabase adds, how to add Sentry, and what to check daily after launch.

LovableGuide

Lovable's Quick scan runs on every publish; the Deep scan reviews your code. What each checks, what Lovable says they can't promise, and what a repo check adds.

SupabaseLovableComparison

Lovable Cloud runs a Supabase backend Lovable manages; your own Supabase gives you the dashboard and keys. No switch button: moving off is export and restore.

LovableGuide

Lovable retired Test and Live on October 23, 2026 and deletes the detached Test databases on December 1. Drafts preview code, not data: they use your live DB.

LovableGeminiGuide

Lovable retires Gemini 3.6 Flash for app AI features on Nov 19, 2026 and 3.7 Flash on Jan 28, 2027, routing them to Gemini 3.8 Flash. Some retired models fail.

RailwayGuide

Railway stops reading railway.json and railway.toml on December 1, 2026. Run railway config migrate; npx -y viberaven changes finds them in your repo.

SupabaseStripeRailwayGuide

Railway says an attacker decrypted environment variables for a subset of workspaces in October 2026. Roll every secret stored there, then reconnect GitHub.

CursorChecklist

Check a Cursor-built app before launch: auth, env vars, billing, database, deploy, monitoring and tests, plus what a repo check covers on Vercel + Supabase.

Claude CodeChecklist

Check a Claude Code-built app before launch: auth, env vars, database rules, Stripe webhooks, Vercel deploy, monitoring, tests and the next Claude prompt.

Claude CodeResearch

A local Claude Code pilot compares project rules and generated hooks: an approved commit was blocked, with coverage limits and a manual compaction followup.

CodexGuide

Production readiness for Codex-built apps: map the stack, verify auth and billing, check deploy and monitoring, and write focused Codex prompts.

Check an AI-built app's auth before launch: server-side enforcement, callback URLs, sessions, route protection, user ownership and the next coding-agent prompt.

ClerkChecklist

Clerk production checklist for AI-built apps: production instance, live keys, domains, redirect URLs, OAuth, webhooks, Vercel env vars and authorization.

ClerkGuide

Since @clerk/nextjs 7.8.0, a Next.js app with no Clerk keys throws instead of running keyless. Set both keys locally and on Vercel, then redeploy.

ClerkGuide

Since October 19, 2026, the Clerk Dashboard shows a Secret key in full only when you add it. Add a new key, set CLERK_SECRET_KEY, redeploy, delete the old.

ClerkGuide

Since October 26, 2026, Clerk sends no email to +clerk_test addresses in Test mode. Sign in with code 424242, or use a real inbox for links and invitations.

Auth.jsChecklist

Check Auth.js or NextAuth before production: AUTH_SECRET, AUTH_URL, provider callbacks, cookies, middleware, adapters, preview URLs, and server authorization.

VercelAuth.jsGuide

NextAuth stops in production without a secret: set AUTH_SECRET or NEXTAUTH_SECRET in Vercel and redeploy. On Vercel you need no NEXTAUTH_URL or AUTH_TRUST_HOST.

Auth.jsGuide

Auth.js v5 throws UntrustedHost when trustHost is off in production. On Vercel the VERCEL variable turns it on; self-hosted, set AUTH_TRUST_HOST=true.

Auth.jsGuide

Auth.js v5 logs MissingSecret when no AUTH_SECRET reaches the server. Generate one with npx auth secret, add it in Vercel for each environment, redeploy.

VercelBetter AuthGuide

Better Auth answers 403 Invalid origin when the Origin is not in trustedOrigins. Add your preview URL pattern, scoped to your project, not *.vercel.app.

SentryGuide

Do AI-built apps need Sentry before launch? When error monitoring is required, what to check first, and what the one VibeRaven monitoring note covers.

SentryChecklist

Set up Sentry in a Next.js or Vite + React app on Vercel, from Sentry's docs: wizard, DSN, environment, release, source maps, test errors and one alert.

VercelPostHogGuide

No events after a Vercel deploy? Trace one action from the Vite build to PostHog: env names, region, consent, blocked requests and duplicate pageviews.

SentryGuide

Sentry logs Invalid Sentry Dsn: undefined when an unset DSN variable became the text "undefined". Set it where the app builds, pass it as is, redeploy.

VercelSentryGuide

Minified Sentry stack traces on Vercel mean no source maps reached Sentry for that build. Set SENTRY_AUTH_TOKEN in Vercel, use withSentryConfig, redeploy.

PostHogGuide

PostHog says the phc_ project token can be public: it sends events and evaluates flags. A phx_ personal API key or a phs_ secret key must stay on the server.

SupabaseStripeGuide

Stripe webhook errors in AI-built Next.js, Vercel and Supabase apps, one page each: signature errors, raw body, secrets, Checkout, duplicates, Edge Functions.

StripeGuide

Stripe "No signatures found matching the expected signature for payload": the body was parsed before verification or the whsec_ secret is wrong. Use req.text().

StripeGuide

In a Next.js App Router route handler, read a Stripe webhook body with await req.text() and pass it to constructEvent unchanged. No bodyParser config needed.

StripeComparison

Yes: every Stripe endpoint has its own whsec_ secret, a different one per mode, and stripe listen prints a third. Which secret goes in which environment.

StripeGuide

Yes, if access depends on the payment. Stripe says the Checkout success page is not reliable for fulfillment, and subscriptions need webhooks. What to handle.

StripeGuide

Stripe can deliver the same webhook event more than once. Record each event ID with a primary key, in the same transaction as the grant, and skip repeats.

SupabaseStripeGuide

Stripe throws "SubtleCryptoProvider cannot be used in a synchronous context" in Supabase Edge Functions. Verify with constructEventAsync instead.

StripeGuide

Stripe API 2026-09-30.endive removed payment_method_types, and stripe-node 23 pins it. Delete the param, or pass allowed_payment_method_types instead.

StripeGuide

From December 2026 Stripe MCP rejects full-access secret keys and restricted keys without the Agent tag with a 401. Use OAuth or an agent API key instead.

StripeGuide

stripe-node throws it when new Stripe() gets an empty key, such as STRIPE_SECRET_KEY unset at build time. Invalid API Key provided means Stripe rejected it.

StripeGuide

Stripe says No such price when the price ID is not in the account or mode of your secret key, often a test price with a live key. Use that mode's price ID.

VercelStripeGuide

Vercel Deployment Protection stops Stripe before your route on preview URLs. Add x-vercel-protection-bypass to the endpoint URL, with a secret just for Stripe.

PaddleGuide

Paddle signs ts:rawBody with the destination secret. Verification fails if the body was parsed, the pdl_ntfset_ key is wrong, or the ts is over 5 seconds old.

PolarGuide

Verify Polar webhooks in a Next.js route with Webhooks from @polar-sh/nextjs and POLAR_WEBHOOK_SECRET, then grant access on subscription.active.

Lemon SqueezyGuide

Lemon Squeezy signs the raw body with HMAC SHA-256 in X-Signature. Read it with request.text(), use that webhook's signing secret, compare hex digests.

SupabaseResendGuide

A Resend webhook into a Supabase Edge Function needs verify_jwt = false, then svix on the raw body. Parsing JSON first fails with No matching signature found.

SupabaseStripeClaude CodeGuide

Check an app Claude Code wrote: Stripe webhook signatures over the raw body, env vars per Vercel environment, and Supabase RLS policies tested as real roles.

StripeChecklist

Stripe webhook checklist for AI-built SaaS: checkout, signing secret, idempotency, subscription state, entitlements and prompts that verify billing end to end.

VercelGuide

The Vercel problems AI-built apps hit after deploy, one question per page: env vars, NEXT_PUBLIC_ keys, 404 on refresh, function crashes and timeouts.

VercelChecklist

Use this Vercel preview-to-production checklist for AI-built apps: env vars, domains, redirects, webhooks, build settings, monitoring, and rollback readiness.

VercelGuide

Vercel applies environment variable changes only to new deployments. Redeploy without the build cache; NEXT_PUBLIC_ values change only in a new build.

VercelGuide

"This Serverless Function has crashed" (500 FUNCTION_INVOCATION_FAILED): read the first error in the Logs tab. Often an env var is unset for that environment.

VercelGuide

A Vercel function that runs past its max duration returns 504 FUNCTION_INVOCATION_TIMEOUT. The limit on each plan, how to raise maxDuration, and when to stream.

VercelGuide

A Vite or React single-page app on Vercel returns 404 on refresh because no file exists at that path. One rewrite to index.html in vercel.json fixes it.

Yes. Next.js inlines every NEXT_PUBLIC_ value into the JavaScript it sends to the browser at build time. Which keys are safe there, and which never are.

VercelGuide

Vercel now calls sensitive environment variables Secret: write-only once saved. What that protects, and why a NEXT_PUBLIC_ value still reaches the browser.

SupabaseVercelGuide

The Supabase integration syncs POSTGRES_URL, the Supabase keys and two NEXT_PUBLIC_ variables to Vercel. Which one each part of your app should read.

SupabaseVercelGuide

Your project's URL and Key are required (or supabaseUrl is required.) means the Supabase URL or key env var was empty. Set both in Vercel and redeploy.

VercelGuide

Vercel stopped building with Node.js 20 on 2026-10-01. Change engines.node in package.json, or the Project Settings version, to 24.x or 22.x, then redeploy.

Since create-next-app 16.4, a page that reads cookies() or uncached data outside Suspense fails next build. Wrap the read in Suspense, or cache it.

"Failed to collect page data for /route": importing that route threw during next build, such as a client made from a missing env var. Read the error above it.

VercelGuide

Vercel builds with CI=1, so pnpm refuses a pnpm-lock.yaml that no longer matches package.json. Run pnpm install locally and commit it with package.json.

VercelGuide

Vercel returns 500 MIDDLEWARE_INVOCATION_FAILED when middleware.ts or proxy.ts throws, often a client made from a missing env var. Read the runtime log first.

VercelGuide

Vercel returns 404 DEPLOYMENT_NOT_FOUND when no deployment answers that URL: a typo, a deleted preview, or a domain not added to the project. Check the URL.

next build fails when a Client Component reads useSearchParams() on a static page with no <Suspense> above it. Wrap the smallest part that reads it.

A page from an old build called a Server Action ID the new build does not have, so Next.js answers 409. Use Skew Protection or a fixed encryption key.

Next.js fixes seven medium vulnerabilities on November 3, 2026. Until then, run 16.4.1 or later, or 15.5.28, for the critical October 14 fixes.

VercelGuide

Vercel CI runs the Turborepo tasks you tag ci on every git push and posts a GitHub check. Beta since October 28, 2026: setup, CLI and MCP, limits, pricing.

Next.js 16.4 adds the next-bundle-optimizer agent skill and next analyze export. Install it, run it in report mode, compare before and after snapshots.

VercelGuide

Vercel will not store a NEXT_PUBLIC_ or VITE_ variable as a Secret, because the build ships it to the browser. Public value: Config. Secret: drop the prefix.

Next.js 16 rejects export const dynamic when cacheComponents is on. Delete it, move request-time reads into Suspense, and use "use cache" for force-static.

An open tab asked for a lazy chunk your new deploy deleted. Reload on the vite:preloadError event and serve index.html with Cache-Control no-cache.

A blank page with this error means the script URL returned HTML, often index.html from a SPA fallback. Fix the Vite base or the path the host serves it from.

VercelGuide

A streamText reply that stops partway on Vercel hit maxDuration. Fluid compute defaults to 300 s; a maxDuration = 30 left from an old example cuts it at 30 s.

VercelNeonGuide

Neon refuses direct connections (53300) once max_connections fills, often from Vercel functions. Use the -pooler host in DATABASE_URL, one pool per instance.

VercelFirebaseGuide

firebase-admin throws it when the private key env var holds literal \n instead of line breaks, as pasted from the JSON. Replace \\n with \n where you read it.

VercelFirebaseGuide

Firebase throws auth/unauthorized-domain when the page host is not in Authorized domains. Add the Vercel host in the Firebase console; previews need theirs.

allow read, write: if true lets anyone who has your project ID read, change or delete Firestore data. Require sign-in, scope rules to the owner, test, deploy.

openai-node refuses to run in browser code because the key would reach every visitor. Move the call to a server route; drop the NEXT_PUBLIC_ or VITE_ prefix.

SupabaseVercelGuide

On Vercel, connect to Supabase through the transaction pooler on port 6543, not the 5432 session pooler; set prepare: false (pgbouncer=true in Prisma).

VercelGuide

Diagnose Google login failures after a custom-domain launch. Separate Lovable Cloud settings, Supabase callbacks and app redirect URLs before changing code.

SupabaseGuide

Google shows Error 400: redirect_uri_mismatch when the OAuth client lacks the Supabase callback URL. Add https://<ref>.supabase.co/auth/v1/callback to it.

SupabaseNeonComparison

Compare Supabase and Neon for Postgres, backend services, preview branches, pooling and costs. Decide with a realistic app workflow and migration checklist.

PostHogGoogle AnalyticsComparison

Compare PostHog and GA4 for acquisition, product funnels, replay, identity, cost and implementation. Decide what to measure and when both tools make sense.

SupabaseFirebaseComparison

Compare Supabase and Firebase for SQL, documents, offline apps, auth, pricing and migration. Choose a backend around the application you actually need.

LovableBoltComparison

Compare Lovable and Bolt for building apps, databases, GitHub, hosting, pricing and handoff. Choose around your workflow, not a screenshot contest.

SupabaseClerkComparison

Compare Supabase Auth and Clerk for login UI, organizations, pricing, database permissions and migration. Learn when to choose either or use them together.

SupabaseComparison

No single tool covers a Supabase app. 15 tools for migrations, the database, the deployed app and secrets: what each catches, misses and costs.

SupabaseVercelGuide

The Supabase, Vercel, Stripe and PostHog MCP servers: URL, what each reads and changes, how it signs in and the safety settings to use. Checked 2026-10-23.

Which AI app generators produce production-ready code? None by itself. What Lovable, Bolt, v0, Replit Agent and coding agents check, and what stays yours.

Compare vibe coding tools by job: Lovable, Bolt, Cursor, Claude Code, CodeRabbit, VibeRaven, Vercel, Supabase and Sentry, with checks before launch.

VibeRaven, CodeRabbit, GitHub Copilot code review or Greptile? Compare review workflows, app maintenance and the live checks still needed before release.

Open the local Studio for an existing AI-built app, connect your coding agent, review changes, or run an optional repository check from the terminal.

The @viberaven/cli npm package (npx -y viberaven) checks AI-built Vercel + Supabase apps for repo launch gaps and gives your coding agent one scoped fix prompt.

A first-hand teardown of how VibeRaven approaches an AI-built Vercel + Supabase app: repo evidence, provider checks, named repo gaps and the next agent prompt.

An index of common launch gaps in AI-built apps, from VibeRaven dogfooding and repo patterns: auth, billing, data, deployment, monitoring and tests.

Before you launch an AI-built app, verify the systems behind the demo: authentication, data access, payments, deployment, monitoring, and recovery. This overview explains what readiness means and when to move to a detailed launch checklist.

VercelChecklist

When Vercel environment variables are not working in production, a variable that works locally but is undefined on Vercel is usually missing from the Production environment, read under a different name, or newer than the deployment: Vercel applies variable changes to new deployments only. Check the name, the environment, build time vs runtime, redeploy, then test the result.

SupabaseLovableResearch

We read the policies an AI app builder ships with, not the live databases. One in six public Lovable projects lets anyone change or delete a whole table, often under a policy name that says otherwise.

SupabaseLovableResearch

Nearly half of the Lovable projects we read ship a Postgres function that skips RLS and that anyone with the public anon key can call. We read the functions in 18 of them to see what a signed-out caller could actually do.

SupabaseLovableResearch

29 of 512 public Lovable repos (5.7%), each read at its last commit before October 3, 2026, commit a Supabase service role or secret key, the key that skips RLS. The key is rarely in the app itself. It sits in a one-off script, a deploy guide, or the .env.example that was meant to hold placeholders.