People get logged out, or logged in as somebody else.

Built with one of these? You're in the right place.

Lovable

Lovable projects usually break at the Supabase edge: environment variables that never reached production, or row-level security left open on a table that holds real customer data.

Bolt

Bolt ships fast and leaves the build config behind. The deploy fails on a missing package, a Node version, or an API key that only ever existed in the preview.

Replit

Replit apps run fine in the workspace and 500 on a real domain: ports, file paths and secrets that were never wired up for the deployed process.

Cursor

Cursor edits confidently across files it has not read. Two features end up disagreeing about the same state, and the bug moves every time you fix it.

v0

v0 gives you the interface, not the wiring. Forms post to nothing, server actions are still stubs, and auth is a component rather than a session.

Windsurf

Windsurf refactors reach further than intended. Imports, types and routes drift apart until the build stops on something unrelated to what you changed.

Base44

Base44 apps hit their ceiling at data and roles: the model that fit the demo cannot carry a second kind of user without redoing what sits underneath it.

Claude Code

Claude Code writes real code, which means real dependencies, migrations and tests. When it breaks, it breaks somewhere prompting cannot reach.

What it usually turns out to be

It works locally, then 500s once deployed

Nearly always an environment variable, a build step or a file path that only exists on your machine. The code is usually fine.

The AI keeps fixing the same bug

Each pass patches the symptom because the cause sits a layer down, in the data model or in how state is shared. Prompting harder does not reach it.

Forms submit but nothing arrives

The browser gets a success back while the server quietly fails. Without error handling and logs nobody finds out until a customer complains.

Logins drop or leak between users

Session and auth code copied from an example built for a different rendering model. It looks right in testing and breaks under real traffic.

And what nobody notices until later

Security is the part an AI builder is quietest about. None of these stop the app working, which is exactly why they ship.

The database is open to anyone with the URL

Supabase and Firebase hand the browser a key on purpose — the row policies are what actually guard the data. Generated projects routinely ship with those policies off, which turns a public key into a key to everything.

Secrets that shipped to the browser

A service key pasted into a component, or one prefixed NEXT_PUBLIC_ so the build would stop complaining. It is in the page source, readable in devtools, and the bill for it is yours.

Any logged-in user can read every other user's data

The endpoint takes an id and returns that record without ever asking whose it is. Nothing looks wrong while you are the only account; change the number in the URL and you are in someone else's.

Nothing stops the same request a thousand times over

No rate limit and no real validation on the public routes, so login, password reset and checkout can each be hammered until something gives. Generated code almost never adds this on its own.