Guide

The stranger test: 10 things that break the first time a real customer signs up

Can a stranger actually sign up and get your email? Between 23 September and 21 October 2026, people ran 61 free checks on live apps with VibeFix: an AI agent signs up to the live app as a brand-new person, with a real inbox, on a phone and a computer. 54 checks finished with a result, and 39 of those 54 found at least one problem a new customer would hit, 95 problems in all. Below are 10 of them, grouped and counted, most common first, with how to check each one yourself.

Where these numbers come from

Counts only, from our own records of the free checks. Our own test apps and accounts are left out, and no app or owner is named. Each result can count once per item. A check sees what a new person sees on one visit, so a count is what showed up, not everything that could go wrong.

Two things people often expect did not show up in these 54 results: confirmation links that open localhost, and email rate limits. Redirects that land in the wrong place came up twice. If your app sends sign-up emails, the guides on Supabase redirect URL localhost: keep it for testing, send real users to your live app and Lovable email rate limit exceeded (and the Supabase "email rate limit exceeded" error): what is being limited cover those.

The checklist

Copy it and go through it on your live app, signed out, with an address that has never used the app.

``` The stranger test (live app, signed out, brand-new address, on a phone and a computer)

[ ] 1. On a phone, every button is easy to tap and no page is wider than the screen [ ] 2. Signed out, nobody can read other people's data, keys or admin pages [ ] 3. Every link and page opens, including after a refresh [ ] 4. Sign-up, sign-in and the emails are in the app's language [ ] 5. No errors in the console on load or right after sign-in [ ] 6. The first screen loads fast on a phone over mobile data [ ] 7. A new visitor can find a working sign-up from the home page [ ] 8. The sign-up email comes from your domain and its link opens your live app [ ] 9. Sign-up asks the person to confirm their email [ ] 10. A brand-new account can finish setup and save its first item ```

The 10 things, and how to check each

1. On a phone, buttons are too small to tap or the page is wider than the screen

In our checks: 12 problems in 10 of the 54 results: small menu buttons, sign-up and login buttons too small to tap, a password show/hide button too small, a landing page that shrinks and zooms out, a setup wizard that does not fit the screen.

How to check it

Open your live app on a real phone, signed out, and sign up using only your thumb.
W3C's WCAG 2.2 minimum for a tap target is 24 by 24 CSS pixels (with exceptions for spacing). Anything smaller is easy to miss.
Make sure the page has a viewport meta tag with width=device-width, so it is not drawn at desktop width and shrunk.

Source: W3C: Understanding WCAG 2.2, Target Size (Minimum) · MDN: The viewport meta tag

Full steps: My builder says the app is tested, but my customers hit problems

2. Data, keys or admin pages can be read without signing in

In our checks: 8 problems in 7 results: other people's records readable while signed out, an API key readable by every visitor, an API manual with the admin sign-in left public, paid content open to everyone, AI endpoints answering signed-out requests.

How to check it

Open the app in a private window, signed out, and try every page and link that shows data.
On Supabase, enable row-level security on every table with policies; Supabase says tables without it "allow any client to access and modify their data".
Keep secret keys on the server, never in code the browser loads.

Source: Supabase: Production checklist

Full steps: Users can see other users' data in my Lovable app · Is a secret key or admin page visible on my live app?

3. A page or link opens blank or goes nowhere

In our checks: 7 problems in 6 results: a results page that loads completely blank, a page that opens showing raw code, a broken link in the main navigation, an app address that does not exist, a link that opens a blank white page.

How to check it

Signed out, click every link in the navigation and footer.
Open a page deep inside the app, then refresh it.
Open the link in your sign-up email on a phone.

Full steps: My app shows a blank white page after publishing · "Page not found" when I refresh a page or open a shared link

4. The sign-in or sign-up screens are in the wrong language

In our checks: 6 problems in 5 results: a sign-in page in a different language from the rest of the app, English pages laid out right to left, sign-up labels in one language on a site written in another.

How to check it

Go through sign-up in every language your app offers, on a phone.
Check the email and the screens after sign-up, not only the home page.

Full steps: Why your first customer leaves: what we found testing 37 newly launched AI-built apps

5. Errors fire while the page loads or right after sign-in

In our checks: 4 problems in 4 results: a background request failing on every page after sign-in, JavaScript errors on load.

How to check it

Open your live app with the browser console open, sign up as a new person and watch for red errors.
Do it once on a phone as well; one of these showed up on a phone.

Full steps: My app is stuck on a loading spinner after I publish it · A button on my app does nothing after I published it

6. The first screen is slow

In our checks: 4 problems in 4 results: a list that took about 45 seconds to fill, a first lesson that took 14 seconds with no progress shown, a gallery that loaded 210 MB.

How to check it

Load your live app on a phone over mobile data, signed out, and time the first screen.
If something takes seconds, show progress and load less up front.

Full steps: It works in the preview but breaks after I deploy

7. There is no way to create an account

In our checks: 3 results: the app needed an account, and a new visitor could not find any way to create one or ask for access.

How to check it

Start on your home page, signed out, and count the taps to a working sign-up form.
If the app is invite-only on purpose, say so and show how to ask for access.

Full steps: Why your first customer leaves: what we found testing 37 newly launched AI-built apps · New users sign up, then land back on the login page or see an error

8. The sign-up email looks wrong, or its link does nothing

In our checks: 3 problems: a sign-up email sent from an unrelated domain, so it looked like phishing; a verify link that landed on a page without confirming anything; an email sign-in that kept spinning when the bot check failed.

How to check it

Sign up with a brand-new address that is not on your team, and read the email on a phone.
Send from your own domain with DKIM, DMARC and SPF set up, as Supabase recommends for custom SMTP.
Make sure the link opens your live app: the Site URL and Redirect URLs decide where it lands.

Source: Supabase: Send emails with custom SMTP · Supabase: Redirect URLs

Full steps: Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44) · Supabase redirect URL localhost: keep it for testing, send real users to your live app

9. Sign-up lets anyone in without confirming the email

In our checks: 2 results: sign-up accepted any address and signed people straight in, in one case giving away an unlimited free trial.

How to check it

Sign up with an address you do not own. If you get in, confirmation is off.
Supabase says email confirmation is on by default for hosted projects; Lovable warns that without it "anyone can sign up with an address they don't own".

Source: Supabase: Password-based auth · Lovable: Email authentication for your app

Full steps: Supabase email not confirmed error (AuthApiError: Email not confirmed): why a new user is refused

10. A new user gets stuck right after signing up

In our checks: 2 results: onboarding froze on step 4, and a Continue button in the setup did nothing.

How to check it

Finish the whole first-run setup as a brand-new account, on a phone and a computer.
Watch the first save: a new user's first row is where database rules often block.

Full steps: Row-level security error saving a profile right after sign-up · Data won't save: "new row violates row-level security policy"

One prompt for Claude, Cursor or Lovable

Paste this into your AI tool. It checks your code and settings against the list and changes nothing until you say so.

`` Check my app for the 10 things that most often break when a brand-new customer signs up. For each one, answer yes, no or unsure, name the file or setting, and give the smallest fix. Do not change anything until I say so. 1. On a phone 375 px wide, every button and link is at least 24 by 24 CSS pixels, no page is wider than the screen, and the viewport meta tag uses width=device-width. 2. A signed-out visitor cannot read other people's data, API keys, admin pages or paid content. Every table has row-level security with policies. 3. Every navigation link and every page opens for a signed-out visitor, including after a refresh on a deep page. 4. Sign-up, sign-in and the emails are in the same language as the rest of the app. 5. No errors fire in the browser console while pages load or right after sign-in. 6. The first screen loads quickly on a phone over mobile data; nothing big loads up front. 7. A new visitor can reach a working sign-up form from the home page. 8. The sign-up email is sent from my own domain, and its link opens my live app (Site URL and Redirect URLs), not localhost or a preview. 9. Sign-up requires email confirmation. 10. A brand-new account can finish onboarding and save its first item. ``

Why you can't see it yourself

You're signed in, your customers aren't. Your address is on the team, your session is saved, and you test on the computer you built on. The items above only appear for a person with none of that, and your AI tool reads your code, not a stranger's inbox or phone.

Frequently asked questions

What is the stranger test?

Opening your live app as someone who has never seen it: signed out, a brand-new email address, on a phone and on a computer, all the way through sign-up, the email and the first thing a customer does.

Where do these numbers come from?

From 54 free checks that finished with a result between 23 September and 21 October 2026. 39 of them found at least one problem, 95 in all. Our own test apps and accounts are excluded, and no app is named.

Why are localhost links and email rate limits not on the list?

Neither showed up in these 54 results. Both are well documented by Supabase, so if your app sends sign-up emails they are still worth checking with the guides linked above.

Can my AI tool run this checklist for me?

It can check your code and settings with the prompt above. Whether a new person on a phone actually gets the email and gets in only shows on the live app, from outside.

Does VibeFix fix these problems?

No. The free check shows how many problems a new customer hits and what each one is. For $9 you get the cause in your app, a fix prompt for your AI tool and 3 re-checks. It does not promise a fix; it shows what the agent saw.

Sources (official documentation)

Related guides

VibeFix is independent. Claude, Cursor, Lovable and Supabase are trademarks of their owners.

Fixed it? Prove a real stranger gets in

A checklist you ran from your own account proves nothing about a new customer.

Free check. Paste your live app's link: an AI agent signs up once as a brand-new person ("VibeFix Test") with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.

$9 for one app. Tells you which cause is breaking your app and where, gives you a fix prompt written for your app, and includes 3 re-checks so you can see the result from the outside. It does not promise a fix; it shows what the agent saw.

Your AI reads your code. VibeFix signs up like a stranger: free check.

More guides