Works in the Demo, Breaks in Production: The 6 Vibe-Code Failures
The six most common reasons AI-built apps (Lovable, Bolt, v0, Replit, Cursor) fail in production — and how to triage them without going in circles.
Every rescued vibe-coded app I've seen failed for a variation of the same six problems. If your AI-built app works in the preview but falls apart with real users, triage it in this order.
1. Authentication that only worked in the sandbox
Sessions drop, password resets 404, OAuth loops back to the login page. Usually: redirect URLs still pointing at the dev/preview domain, cookies misconfigured for the production domain, or the AI mixed two auth patterns that fight each other. Google sign-in redirecting to localhost:3000 is the most common variant (full fix); missing confirmation emails are usually SMTP, not frontend code (email guide).
Triage: open the browser dev-tools Network tab during login. The first failing redirect or 401 tells you which layer is lying.
2. Database security that doesn't exist
The app "works" because every table is publicly readable and writable — row-level security is off. This is the silent one: nothing looks broken until your data leaks. Roughly 70% of Lovable apps ship this way (how to check and fix).
Triage: Supabase Table Editor → look for "RLS disabled" badges. This one is urgent even though nothing "looks" broken.
3. Payments that succeed without fulfilling
Stripe takes the money; your app never finds out. Webhook endpoint on the wrong URL, wrong signing secret, or a parsed request body breaking signature verification (the five causes).
Triage: Stripe Dashboard → Webhooks → recent deliveries. The response codes tell the story.
4. Environment & CORS chaos
Works locally because .env had everything; production has half of it. Symptoms: blank pages, "undefined is not a function" in the console, API calls blocked by CORS, or — worse — secret keys shipped into the frontend bundle because the AI didn't know the difference.
Triage: compare local .env against the hosting provider's environment variables line by line, then check the browser console for CORS errors and grep the built JS for sk_live / service_role.
5. Deploys that fail or half-succeed
Build passes but the page is blank; custom domain shows an old version; every deploy needs a manual ritual someone has to remember. There's no CI/CD, no rollback, no monitoring — the AI built an app, not an operation.
Triage: can you answer "what exactly runs in production right now, and how do we get back to the previous version?" If not, this is your problem even when nothing is currently on fire.
6. The AI is going in circles
The meta-failure: every prompt fixes one symptom and creates two more. This happens because the codebase has accumulated contradictory patterns — three ways of fetching data, two auth flows, dead code the AI keeps "fixing." Past a certain entropy point, prompting is negative progress. If the app broke after a Lovable update or a half-finished "security fix," start with the regression triage (post-update guide).
Triage: if the last ten prompts haven't produced net progress, stop prompting. The codebase needs a human root-cause read, and possibly a scoped rebuild of the rotten parts.
The honest way out
These six failures compound — broken env vars cause webhook failures cause "fixes" that break auth. Fixing them one symptom at a time is how you got here.
I do it the other way around: a fixed-price $299 triage reads the entire codebase, finds the root causes, and gives you a video walkthrough + written report with an honest rescue-vs-rebuild recommendation — in 48 hours, before you spend anything on fixes.
Stuck? I'll fix it for a fixed price.
I'm a senior full-stack engineer who audits, fixes, hardens, and deploys broken Lovable, Bolt, Cursor, v0, and Replit apps. Fixed price — diagnose before I touch a line of code, so you stop burning credits on prompts that make it worse.
Vibe-Code Rescue — from $299