The failure catalogue

What breaks AI-built apps between the demo and production.

These are the problems I fix, written out properly rather than listed as services. Find yours by the tool you built with or by what your app is actually doing wrong. Each page names the specific failures, explains the mechanism, and shows what “fixed” looks like as a test we agree before you pay anything.

By what you built it with

• Built with Lovable?Your Lovable app works in the preview. It breaks in production.Row level security is off, or the policy is effectively `true` · Secrets inlined into the browser bundle · The anon key doing work the service role should do
• Built with Bolt.new?Your Bolt.new app runs fine in the preview. The published version doesn't.Publish is the first production build, and the first stranger to load it · Bolt Database exists; the screen you shipped may never have been wired to it · Bolt's Secrets tab does keys right; the audit finds the calls that skipped it
• Built with Replit?Your Replit app works in the workspace. The published version doesn't.The link you shared was the dev URL, and it died · Production runs against a different database, which starts empty · The deployment has its own secrets, and one missing key takes the app down
• Built with v0?Your v0 app looks ready to ship. The part that breaks is the part you can't see.The screens can be finished while the data is still mock · Server actions with no check on who is calling · Route handlers that return whatever id you ask for
• Built with Base44?Your Base44 app works when you use it. It breaks when your customers do.Entity permissions that let any user read the lot · Your login page belongs to the platform · The GitHub repo is not an exit
• Built with Cursor?Your Cursor app runs on your machine. That is the only place it has ever been tested.No tests, so every new prompt gambles the old features · The agent edits files you never asked it to touch · Nobody has read the handlers that guard your data
• Supabase in productionYour Supabase app works locally and breaks in productionServerless traffic exhausts your Postgres connections · Queries that were instant in dev start dying at the 3 second statement timeout · Edge functions get two seconds of CPU per request
• Next.js on VercelYour Next.js app works locally and breaks on VercelThe page was rendered once, at build time · The write worked, but nothing told the cached page · Props carry the whole database row to the browser

By what it's doing wrong

• Payments taking money and doing nothing?Stripe took the money. Your customer got nothing.Provisioning happens on the success redirect · The webhook signature is never verified · No idempotency, so retries double everything
• Cross-tenant data leakYour customers can see each other's data. It is never just the one screen you found.One permissive policy overrides every strict one you wrote · Queries scoped to the record, never to the organisation · The record id is the only credential
• Users locked out?Users can't sign in. It worked every time you tested it.Redirect URLs still point at the preview domain · The default email sender is capped, and reset links bind to one browser · Session refresh signs users out instead of keeping them in
• Deploy keeps failing?It runs on your laptop. It will not deploy anywhere else.The environment variables only exist on your laptop · The build leans on state that lives only on your machine · Nothing pins the Node version
• AI feature you can't trust?Your AI feature is impressive when it works. You can't put it in front of a customer.The output is parsed with string matching, and the model does not always cooperate · Provider errors are treated as impossible · No timeout, so one slow call hangs the whole feature
• The cost questionWhat it costs to get an AI-built app production readyThe spec is a symptom, not a failure · No acceptance test, no finish line · One place or a pattern: the blast radius
• Email deliveryTransactional emails never arriveYour DNS never authorised anyone to send as your domain · Gmail and Yahoo stopped tolerating unauthenticated mail in 2024 · You are still on the platform's test mailer
• Works locally, fails liveFile and image uploads broken in productionThe 413 you never saw locally · The file goes through your function instead of past it · Timeouts are a different failure from the 413
• Slow with real dataThe app is unusably slow with real dataOne query per row in the list · Foreign keys with no index behind them · No pagination, so every visit fetches the whole table
• The console says CORS. curl says 200.CORS errors are blocking your frontend from your own APIThe preflight arrives with no credentials, and your auth rejects it · A wildcard origin with credentials, rejected or reflected · A 500 dressed up as a CORS error

Not listed here? The list is what recurs, not what I can fix. If your blocker is somewhere else entirely, tell me in two sentences and you'll get a yes, a no, or one question within a working day.