Fixes
It worked in the AI tool. Then you deployed it.
What breaks when an app built with Lovable, Bolt, v0, Replit or Cursor goes live, and how to fix each one: in plain words, with a request to paste back into the tool that wrote the code. The free launch check finds all of them in your app at once.
Deploys that break
Pages show 404 when refreshed or opened directly
Your Lovable or Bolt app works from the home page, but /dashboard shows 404 on Vercel or Netlify when you refresh it or open a link to it. One small file fixes it.
LovableBolt
New Lovable app shows 404 on every page on Vercel
Lovable projects made since May 2026 use TanStack Start, which renders pages on a server. Built for Cloudflare Workers, they 404 on Vercel until they're built with Nitro.
Lovable
“Could not resolve” on deploy, but it works on my computer
The build fails with Could not resolve './components/navbar' while the app runs fine locally. Usually it's capital letters: Mac and Windows ignore them, the build server doesn't.
“Module not found” on deploy: a package isn't installed
The deploy fails because the code uses a package that isn't in package.json. It worked on your computer because the package happened to be installed there.
Works locally, blank or broken in production: missing environment variables
The deployed app shows a blank page or errors that never happen locally. Usually a key the code reads was set on your computer, or in the AI tool, and never on the host.
LovableBoltv0
Replit Auth and Replit storage don't work outside Replit
An app built by Replit's Agent signs people in with their Replit accounts and keeps files in Replit's storage. Moved anywhere else, nobody can sign in. Change both first.
Replit
Deploy fails its health check: the server always listens on port 5000
Replit apps listen on port 5000. Other hosts tell the app which port to use in PORT, so a fixed port is never reached and the deploy fails.
Replit
Security holes
Supabase tables without Row Level Security: anyone can read and change your data
With Row Level Security off, or a policy of using (true), the public anon key in your app lets anyone read, change or delete every row. The app still works, which is why nobody notices.
LovableBolt
Supabase service-role key exposed in the browser
The service-role key skips every Row Level Security rule. Used in browser code, it's handed to every visitor, who can then read, change or delete your whole database.
LovableBolt
OpenAI or Anthropic API key exposed in the browser
An AI client created with dangerouslyAllowBrowser, or a key behind a VITE_ or NEXT_PUBLIC_ prefix, puts your API key in the page, where anyone can copy it and spend on your account.
LovableBoltv0
Anyone can run up your OpenAI bill
An AI endpoint with no sign-in and no rate limit can be called in a loop by a bot or one curious person, and your AI provider bills you for every request.
LovableBoltv0
.env file and API keys committed to GitHub
A .env file exported with the code puts every key in it where anyone with access to the repository can read them, and deleting the file doesn't remove them from git history.
BoltLovable
API routes and admin pages anyone can call
Routes and server actions that change data without checking who's signed in, and admin pages hidden only by not linking to them, are open to anyone who finds the address.
v0LovableBolt
Firebase rules let anyone write (or test mode is about to expire)
Firestore in test mode, or rules with allow write: if true, let anyone change or delete your data, and test mode switches everything off on its expiry date.
Bots flooding your sign-up or contact form
Public forms with no bot check are the first thing spam bots find. A free, invisible check stops them without annoying real people.
Data, email and payments
Move your data off Lovable Cloud to your own Supabase
An app on Lovable's built-in backend keeps its database on Lovable's cloud. Export it, load it into a Supabase project of your own, and your users keep their passwords.
Lovable
Your app's emails go to spam (SPF, DKIM and DMARC)
Sign-in links and receipts landing in spam usually mean the sending domain isn't set up: no SPF, no DKIM signature, no DMARC record. Gmail and Yahoo now expect all three.
Stripe webhook not verified, or missing
A Stripe webhook that doesn't check the signature lets anyone post a fake “payment succeeded”. Without a webhook at all, subscriptions never update when payments fail or are cancelled.