Blog
Getting beta-ready, one question at a time
Straight answers to the things founders actually hit while getting an AI-built product in front of its first real users. Each post takes one question and answers it.
Security
Are My Firebase Security Rules Leaving My Database Open to the Public?
Firebase in test mode lets anyone read and write your entire database. What security rules are, how to check if yours are open, and the rules a real app needs.
6 min read
Can anyone read my Supabase database from the browser?
If you built with Supabase and haven't set up Row Level Security, yes, a stranger can query your whole database from the browser. Here's how to check in two minutes and how to fix it before your first users.
6 min read
Can My Vibe-Coded App Get Hacked by SQL Injection?
SQL injection lets an attacker turn a form field into a database command. Whether your stack is vulnerable, how to spot risky queries, and the one-line fix.
5 min read
Can Someone Trick My AI Feature Into Ignoring Its Instructions or Leaking Data?
Prompt injection lets users override your AI's instructions with clever input. What it can expose in an agent-built app, and how to keep secrets out of reach.
6 min read
How Do I Know If My App Is Secure Enough to Launch?
A founder-friendly security checklist for agent-built apps: the handful of holes that matter most, exposed data, leaked keys, open routes, and how to check each before your first real users.
7 min read
How Do I Stop Bots From Creating Fake Accounts on My App?
Open signup forms attract bots that flood your database, burn free-tier limits, and skew your numbers. Practical defenses that don't wall out real users.
6 min read
How Do I Stop One User From Running Up My OpenAI Bill?
Without rate limits, a single user or bot can call your AI endpoint thousands of times and drain your budget overnight. Here are simple ways to cap usage per user before you launch.
6 min read
I Accidentally Pushed My API Keys to GitHub, How Bad Is It?
A key committed to GitHub is compromised the moment it's public, even after you delete it. What to rotate first, why deleting the file isn't enough, and how to prevent it.
6 min read
Is It Safe to Let Users Upload Files to My App?
User uploads can carry malware, huge files that rack up storage, or scripts that run on your site. The checks every upload feature needs before real users touch it.
6 min read
npm audit Says I Have Vulnerabilities, Do I Have to Fix Them Before Launch?
Not every npm audit warning is a real risk to your app. How to tell which vulnerabilities actually matter for a launch, and how to fix the ones that do.
6 min read
Someone Could Change the User ID in My API Request and See Other People's Data
If your backend trusts the user ID sent from the browser, anyone can swap it and read other accounts. This is IDOR, what it is and how to check every route for it.
6 min read
What Is CORS, and Should Just Any Website Be Able to Call My API?
A plain-English take on CORS: what the wildcard setting actually allows, when an open API is fine, when it's dangerous, and how to lock it to your own domain before your first users.
6 min read
What is the anon key, and is it safe to expose?
Your public API key showing up in the browser is normal and expected. The danger isn't the key being visible, it's what the key can do when your access rules are missing. Here's the distinction that matters.
5 min read
Accounts & access
My App Has No Password Reset, How Do I Add One Before Launch?
Your vibe-coded app skipped password reset and users will get locked out. Here's the reset flow you need, why email-link reset beats security questions, and how to add it safely before beta.
6 min read
Do I Need to Verify Users' Email Addresses Before My Beta?
Whether email verification is worth it for your first users: what breaks without it (fake signups, typo'd emails, spam), when to require it, and how to add a confirm-email step without scaring people off.
5 min read
Do I Need Two-Factor Authentication for My Beta?
Whether two-factor authentication is a beta must-have or a later add: what it protects, when it matters (payments, sensitive data, admin accounts), and lower-effort alternatives for a first launch.
6 min read
Should I Add Google Login or Just Email and Password for My Beta?
The real tradeoffs of social login versus email/password for a first launch: what Google/GitHub sign-in saves you, what it complicates, and which one gets you to beta faster and safer.
6 min read
How Long Should a Login Session Last Before It Expires?
Pick a session length that isn't annoying or dangerous. How 'remember me' works, why sessions should expire, the difference between access and refresh tokens, and safe defaults for a beta app.
6 min read
My Admin Dashboard Is Just a Hidden URL, Is That a Problem?
Why 'security through obscurity' fails: a hidden /admin route is one guess or leaked link away from exposure. How to actually gate admin pages with a real server-side role check before launch.
6 min read
Is It Safe to Store My Login Token in localStorage?
Why storing auth tokens in localStorage exposes them to any script on your page, how XSS steals them, and when httpOnly cookies are the safer default for your beta app's login.
6 min read
How Do I Make Sure One Customer Can't See Another Customer's Data?
Multi-tenant leakage is the #1 launch-killer for agent-built apps. How data crosses between accounts when the ID comes from the request, and the ownership checks that keep tenants isolated.
6 min read
How Do I Stop People From Guessing Passwords on My Login Page?
Brute-force and credential-stuffing attacks against a wide-open login, explained for non-experts: rate limiting, lockouts, and CAPTCHA, the minimum protection your login needs before real users.
6 min read
How Do I Stop Users From Making Themselves Admin?
Privilege escalation in plain terms: how users self-grant admin by editing requests or role fields your AI agent trusted, and how to make roles server-enforced so no one can promote themselves.
6 min read
Why Are Users Still Logged In After They Click Log Out?
Logout that doesn't invalidate the session is a real security hole. How tokens survive a logout, why clearing the browser isn't enough, and how to actually kill a session server-side.
6 min read
Why Do Some Users See Another Person's Account When They Log In?
The scary 'logged in as someone else' bug explained: how caching, shared sessions, and reused tokens leak accounts between users, and the checks to find and stop it before launch.
7 min read
Payments
Can a User Fake a Successful Payment by Hitting My Success URL Directly?
Yes, if you unlock based on the redirect. Never trust the success_url, verify the payment server-side with the Stripe API or a webhook before granting anything.
6 min read
Do I Need to Be PCI Compliant to Take Payments in My App?
You do, but Stripe Checkout does the hard part for you. Here's what PCI means, why card numbers should never touch your server, and the safe way to collect cards.
6 min read
How Do I Refund a Stripe Payment, and Does It Take Back the Customer's Access?
Refunding money and removing access are separate actions. Here's how to issue a refund, why access stays on unless you revoke it, and how to handle both cleanly.
6 min read
How Do I Test My Whole Payment Flow Before Real Users Hit It?
Use Stripe test cards and the Stripe CLI to run a real payment and webhook locally, with no real money. Here's the exact test-card numbers and listen command.
6 min read
A Customer's Bank Pulled the Money Back, What a Stripe Chargeback Means and What to Do
A chargeback is a customer's bank reversing a charge. Here's what the dispute email means, the fee involved, how to respond with evidence, and how to prevent them.
6 min read
My Customer Got Charged Twice, How to Prevent Double Charges in Stripe
Double charges come from double-clicks, retried requests, or creating two payments. Here's how idempotency keys and disabling the button after submit stop it.
6 min read
How Do I Recover a Customer Whose Card Was Declined Instead of Losing Them?
Declines are normal and often recoverable. Here's how Stripe retries failed cards, sends recovery emails, and how to handle a decline gracefully in your flow so you don't quietly lose paying customers.
6 min read
My Stripe payments work but no real money shows up, test mode vs live mode
You were in Stripe test mode. Here's how to tell test keys from live keys, flip to live, and swap the keys in your vibe-coded app so real cards actually charge.
5 min read
Stripe Called My Webhook Twice, How to Stop Unlocking or Emailing the Customer Twice
Stripe retries webhooks, so your handler can run more than once for one payment. Here's how to make it idempotent by recording the event ID before you act.
6 min read
My Customer Paid but Nothing Happened in My App, Stripe Webhook Not Firing
If checkout succeeds but your app never reacts, your Stripe webhook probably isn't reaching you. Here's how to find out where the event went and fix the endpoint.
6 min read
Stripe Webhook Error: 'No Signatures Found Matching the Expected Signature'
This error almost always means the wrong signing secret or a parsed request body. Here's the raw-body rule, the right webhook secret, and the fix for common frameworks.
6 min read
A User Canceled but Still Got Charged (or Still Has Access), Fixing Subscription State
Canceling in Stripe usually ends access at period end, not instantly, and your app has to listen for the cancel event. Here's how cancellation really works and how to sync it.
6 min read
Reliability
Do I Need a Health Check Endpoint for My App?
A health check is a tiny URL that answers 'am I alive?'. Here's what it's for, whether your beta actually needs one, and how to add a /health route in a couple of lines so monitoring can watch it.
5 min read
Do I Need a Status Page for My Beta?
Status pages look professional, but do you need one for a beta with 20 users? Here's when a status page is worth it, a free way to get one, and what to do instead if it's overkill for now.
5 min read
How Do I Know if My App Is Broken for a Real User?
Right now, if your app breaks for a user, you find out only if they email you. Here's what error tracking actually does, why you need it before your beta, and the two-minute version of setting it up.
6 min read
How Do I Make Sure My App Restarts Itself if It Crashes?
Whether a crash means five seconds of downtime or a dead app until you wake up depends entirely on where you host it. Here's how auto-restart works on serverless vs. a plain server, and how to not stay down.
6 min read
How Do I See Logs From My App Once It's Live?
When your live app misbehaves, logs are how you see what happened. Here's where to find them on Vercel, Netlify, and Railway, what console.log actually does in production, and how to log usefully.
6 min read
How Do I Set Up Error Tracking (Sentry) for My Vibe-Coded App?
A plain-language walkthrough of adding Sentry to a Next.js or React app you built with an AI agent, where the key goes, what you'll see, and how to make sure real crashes actually reach your inbox.
6 min read
My App Works on My Computer but Is Broken When Deployed. Why?
The demo works locally, then the deployed version shows a blank screen or 500 error. Nine times out of ten it's a missing environment variable. Here's how to find which one and fix it.
6 min read
What Are Environment Variables, and Which Ones Do I Need in Production?
Environment variables are the number-one reason vibe-coded apps break on deploy. Here's what they are, how to find every one your app expects, and how to make sure production has them all set.
6 min read
Where Am I Supposed to Put My API Keys in Production?
Your keys shouldn't live in your code, but then where? A beginner's guide to environment variables and secrets in production: where to set them on Vercel, Netlify, or Railway, and how the app reads them safely.
6 min read
Why Do I Only Get 500 Errors in Production, Never on My Machine?
A 500 error in production with no detail is scary and useless. Here's how to read what your host is actually logging, the usual culprits for vibe-coded apps, and how to see the real error message.
6 min read
Why Does My App Crash When More Than One Person Uses It at Once?
Demos are single-user; beta launches are not. Here's why vibe-coded apps break under a handful of simultaneous users, shared state, connection limits, rate caps, and what to check before you invite people.
6 min read
Product readiness
Do I Need an 'Are You Sure?' Before Delete, and How Do I Add One?
One misclick shouldn't wipe a user's data with no warning or undo. Learn which destructive actions need a confirmation step, how to write a clear confirm dialog, and when an undo is better than a popup.
5 min read
How Do I Find Buttons and Links in My App That Go Nowhere Before Users Do?
Agent-built apps are full of buttons that do nothing and links to pages that don't exist yet. Here's a simple way to walk your whole app, catch every dead link and dead button, and fix them before beta users find them.
6 min read
There's Still Fake Demo Data and Lorem Ipsum in My App, Does It Matter for Launch?
Leftover Lorem Ipsum, sample names, and demo rows make your app look unfinished and untrustworthy on day one. Here's how to track down all the placeholder content an agent left behind and clear it before beta.
5 min read
My App Looks Broken When There's No Data, What Should New Users See?
A brand-new user opens your app to a blank screen and assumes it's broken. Here's what an empty state is, why every list and dashboard needs one, and how to add friendly 'nothing here yet' screens before your beta.
5 min read
My App Looks Fine on My Laptop but Breaks on a Phone, How Do I Find and Fix It?
Most of your beta users will open your app on a phone, where agent-built layouts often overflow, overlap, or shrink. Here's how to test on real mobile sizes and fix the layout breaks before you share the link.
6 min read
My App Shows an Ugly Crash When Someone Hits a Page That Doesn't Exist
Mistyped URLs, old links, and stale bookmarks will send users to pages that don't exist. Learn how to add a friendly 404 page that keeps them in your app instead of a scary framework error screen.
5 min read
How Do I Show Form Errors Next to the Field Instead of One Big Error at the Top?
One vague error at the top of a form leaves users hunting for what they got wrong. Learn how inline, per-field validation works and how to add clear messages next to each input before real users fill out your forms.
6 min read
Users Click My Submit Button Twice and Get Duplicates, How Do I Stop It?
If your submit button does nothing visible, users click again, and you get duplicate signups, orders, or charges. Learn how to disable the button and show a loading state so each action only fires once.
6 min read
What Should My App Show When a Request Fails Instead of Just Breaking?
When a network call fails, most vibe-coded apps either freeze, go blank, or show a raw error. Here's how to catch failures and show a calm 'something went wrong, try again' state your beta users can recover from.
6 min read
Why Does My App Flash Blank Before It Loads, and How Do I Add a Loading State?
That blank flash before your content loads makes your app feel broken or slow. Learn why it happens in agent-built apps, and how to add spinners and skeleton screens so users know something is coming.
5 min read
Data & privacy
Do I Need Database Backups Before I Launch My Beta, and How Do I Set Them Up?
Before your first real users touch your app, you need working backups. Here's what could wipe your data, and how to turn on automatic backups in Supabase, Neon, and Postgres.
6 min read
Do I Need to Let Users Delete Their Account and All Their Data?
Real users will ask you to delete their data, and the law often requires it. Here's when account deletion is mandatory and how to build a delete flow that actually clears everything.
6 min read
Am I Storing Passwords or API Keys in My Database in Plain Text?
If you can read a password by looking at your users table, it's stored wrong. Here's how to tell whether your app hashes passwords and keeps secrets out of the database, and how to fix it.
6 min read
How Do I Let a User Download All the Data I Have on Them?
GDPR and CCPA give users the right to a copy of their data. Here's how to build a simple, honest data-export feature for a small app without over-engineering it.
6 min read
How Do I Clear Out Seed and Test Data Before Real Users Arrive?
Your agent seeded fake users, dummy orders, and test@test.com everywhere. Here's how to safely purge seed and test data from production before real users sign up.
6 min read
How Do I Restore My Database If I Accidentally Delete Real User Data?
You ran a bad delete or migration and real user data is gone. Here's how point-in-time restore works, why an untested backup is not a backup, and the exact recovery steps.
6 min read
How Do I Change My Database Schema Without Losing the Data That's Already There?
Renaming a column or adding a constraint can quietly drop rows. Here's how to change your schema safely once you have real user data, including the moves that silently destroy data.
6 min read
Is It Safe to Send Real User Data to My AI Features and Logs?
Your AI features and console.log statements may be quietly shipping personal data to third parties. Here's what happens to data in LLM prompts and logs, and how to stop leaking PII.
6 min read
What Counts as PII, and Which Fields in My Database Are Actually Sensitive?
Not sure if an email, IP address, or user ID counts as personal data? Here's a plain-English breakdown of what PII is, what's extra-sensitive, and how to spot it in your schema.
6 min read
What User Data Is My App Actually Storing, and How Do I Find Out?
Your AI agent added tables and logs you never looked at. Here's how to inventory exactly what personal data your app stores, from database columns to third-party services.
6 min read
Performance
My App Is Fast on My Laptop but Slow for My Users, Why?
Your app feels instant to you because everything is cached and local. Learn why real users on real networks see something slower, and how to close the gap.
6 min read
Why Is My App Making Hundreds of Database Queries to Load One Page?
It's called the N+1 query problem, and AI agents write it constantly. Learn how to spot it and collapse hundreds of queries into one for a fast page.
6 min read
Why Is My App Slow on the First Request but Fast After That?
That first-request lag is a cold start, your serverless backend was asleep. Learn what causes cold starts on Vercel and friends, and how to reduce them before beta.
6 min read
How Fast Does My App Actually Need to Be Before I Launch to Real Users?
You don't need Google-level speed for a beta. Learn the concrete load-time targets that are good enough to launch, and which slowness will actually lose users.
6 min read
My Lighthouse Score Is Bad, What Should I Fix First?
Lighthouse dumps a wall of red on you. Learn how to read the report, ignore the noise, and fix the two or three things that actually move your score before beta.
6 min read
How Do I Make My JavaScript Bundle Smaller So My App Loads Faster?
A bloated JS bundle makes every first visit slow. Learn how to find what's making yours big and cut it down with code splitting and lazy loading.
6 min read
My Images Are Huge and Slowing Down My Site, How Do I Fix Them?
Multi-megabyte images are the number one reason vibe-coded apps load slowly. Learn how to resize, compress, and serve modern formats without a designer, before your first users judge the wait.
6 min read
My Page Loads Thousands of Rows at Once, Should I Add Pagination?
Fetching your entire table on every page load works in a demo and dies in a beta. Learn when to paginate, load more, or use infinite scroll, and how to start.
6 min read
Why Is My Supabase Query So Slow, and How Do I Add an Index?
A slow Supabase query almost always means a missing database index. Learn how to spot it and add the right index in a few minutes, no DBA required.
6 min read
Compliance
What Happens if Kids Under 13 Use My App? (COPPA Explained)
COPPA imposes heavy rules the moment you knowingly collect data from under-13s. Learn how to keep kids out, or what compliance actually requires if you can't.
6 min read
Do I Actually Need a Cookie Consent Banner on My App?
Whether you need a cookie banner depends on what your app actually sets, not on whether everyone else has one. Here's how to tell, and how to do it right.
6 min read
Do I Need a Data Processing Agreement (DPA) With Supabase, Stripe, or OpenAI?
Under GDPR you need a DPA with every vendor that handles your users' data. Good news: Supabase, Stripe, and OpenAI already have one, here's how to accept it.
6 min read
Do I Need a Privacy Policy for a Beta App? (Yes, Here's Why)
Even a beta with 5 users needs a privacy policy the moment you collect an email or sign-up. Here's when it's legally required and what it must say.
6 min read
Does GDPR Apply to My Tiny App With Almost No Users?
GDPR isn't about your size, it's about whether any EU person uses your app. Learn the exact trigger and the handful of things a small app must do to comply.
6 min read
Is It Legal to Email My Waitlist or Beta Signups?
Emailing your signups is fine if you follow CAN-SPAM and GDPR opt-in rules. Here's what counts as consent, what an unsubscribe link must do, and the traps.
6 min read
Is It Legal to Send My Users' Data to OpenAI or Claude?
Sending user content to an LLM API is a data transfer you must disclose. Learn what your privacy policy must say, the DPA to accept, and the training opt-out.
6 min read
Can I Get Sued if My App Isn't Accessible? (ADA and WCAG for Beta)
Accessibility lawsuits target small apps too. Learn where ADA and WCAG apply, the baseline your beta needs, and quick wins your AI agent probably skipped.
6 min read
What Should My Terms of Service Actually Say for an MVP?
A plain-English breakdown of the clauses a beta app's Terms of Service really needs: liability limits, account termination, 'as-is' beta warnings, and disputes. Here's what to include before your first users sign up.
6 min read
Launch
Do I Need a Staging Environment Before I Launch?
Editing the live app while real users are on it is how launches go sideways. Here's what a staging environment is, why a preview copy saves you, and the minimum setup that keeps you from testing in production.
6 min read
How Do I Connect a Custom Domain to the App My Agent Built?
Your app lives at a random .vercel.app or .lovable.app URL and you bought a real domain. Here's how DNS, the A/CNAME records, and www-vs-bare actually connect the two, and why it can take a few hours to work.
6 min read
How Do I Find Out My App Is Down Before My Users Do?
The worst way to learn your app is down is a user's angry message. Set up an uptime monitor that pings your app every minute and texts you when it stops answering. Here's how, using a free tool, in ten minutes.
6 min read
How Do I Know if My App Is Actually Ready to Launch?
You can't tell if it's nerves or a real gap. Here's the honest readiness bar for a vibe-coded app: the eight things that must be true before a stranger touches it, and how to check each one fast.
7 min read
How Do I Keep My App Private With an Invite Code or Password?
For a private beta you want a gate: an invite code, an allowlist, or a password wall. Here are the options from simplest to sturdiest, which one fits a vibe-coded app, and the trap of a fake gate that anyone can walk around.
6 min read
How Do I Undo a Launch That Went Wrong?
Something breaks live and every minute counts. Here's how to roll back to the last working version on the common hosts, why you should test your rollback before you need it, and what a rollback can't undo (like bad data).
6 min read
What's on a Real Launch-Day Checklist for an App I Built With AI?
A concrete launch-day checklist for a vibe-coded app: domain and HTTPS live, payments in live mode, error tracking on, a way to get alerted, and a rollback plan. Copy it and tick each box before you post the link.
6 min read
Why Does My Site Say "Not Secure" and How Do I Get HTTPS?
The "Not Secure" badge and the padlock come down to an SSL certificate on your domain. Here's why it shows up right after you connect a custom domain, how to get HTTPS issued, and why forcing https:// matters before launch.
5 min read
Getting beta-ready
The Demo Works, So Why Isn't My App Ready to Launch?
A demo proves the happy path works once, for you. Launch-ready means it survives strangers, mistakes, and the edges you never clicked. Here's the gap between the two, and how to close it.
6 min read
How Do I Test My App When I'm the Only Person Who's Ever Used It?
You've only ever clicked the path you built. Here's a concrete way to test an app you've never stress-tested, from a fresh browser, a wrong password, a blank form, and the accounts you never made.
6 min read
What Breaks First When a Bunch of People Use My App at Once?
The parts that never buckle for one user are the first to crack under a crowd, costs, rate limits, database rules, and shared state. Here's what fails first when traffic arrives, and how to check before it does.
6 min read
What Does "Beta-Ready" Actually Mean for an App I Vibe-Coded?
"Beta-ready" isn't a feeling or a finished feature list, it's a specific bar across eight areas a stranger will hit. Here's what the term really means and how to tell if you've cleared it.
7 min read
What Should I Ask My AI Agent to Find the Problems in My App?
"Is my app okay?" gets you a shrug. The right prompts get you a real audit. Here are the specific questions to hand your coding agent so it surfaces the security, data, and reliability gaps a stranger would hit.
7 min read
My App Works for Me, Why Does It Break for Other People?
The "works on my machine" problem, explained for people who don't write code. Logins, seeded data, cached state, and your own browser hide the bugs a stranger hits instantly. Here's why, and what to check.
6 min read