Guides
Every page here covers one failure the way it actually happens in an app built with Lovable, Bolt, v0, Cursor or Claude: what the error means, how to see it yourself, what to paste to your AI, and how to check it is really gone. Guides are in English; the scanner speaks English, Spanish, German and French.
- Is my AI-built app leaking? A 15-minute security check
Five checks anyone can run without security training: exposed keys, open tables, other people's data, admin routes, password flows — and how to fix them.
- Bolt.new app broken after deploy? What actually changed
The preview and the deployed site are different machines. The four things that do not survive the trip from Bolt to Netlify or Vercel, and how to fix each.
- Cannot read properties of undefined — find the real cause
What the most common console error actually says, the three situations that produce it in AI-built apps, and why optional chaining is usually the wrong fix.
- Env variables undefined in production (VITE_, NEXT_PUBLIC_)
Frontend env variables are pasted into the code at build time, not read at runtime. Why setting them on the host is not enough, and what must never be VITE_.
- “Failed to fetch” and CORS errors in AI-built apps
What Failed to fetch really means, how to tell CORS from a dead server, why calling APIs with secret keys from the browser fails twice, and the fixes that hold.
- Lovable app shows a blank screen? Find the real error
A blank Lovable app almost always wrote the real error to the browser console. How to read it, the five usual causes, and what to paste back into Lovable.
- Hydration failed in Next.js: fixing v0 and AI-built apps
What hydration actually is, why AI-generated Next.js apps from v0 trip it constantly, the four real causes, and the fix for each — without suppressing it.
- React app blank after deploy: base paths, routers, env
Works in npm run dev, blank in production. The five causes in order: asset paths, routing, env variables, a minified crash — and how to read each one.
- Page works, refresh gives 404: SPA rewrites on every host
Why deep links and refreshes 404 on single-page apps, and the exact two-line fix for Netlify, Vercel, GitHub Pages, Azure Static Web Apps and nginx.
- Supabase RLS: “new row violates row-level security policy”
Why inserts fail with 'new row violates row-level security policy', why reads return empty with no error, and the policies to write instead of disabling RLS.
- How to test an AI-built app before you share it
A tester's pass for people without a tester: the eight checks that catch what actually breaks in AI-built apps, in under an hour, with nothing but a browser.