Guide
Vibe coded app checklist: what a stranger hits on your live app
Most vibe coded app checklists are about code. This one is about the first ten minutes of a person who has never seen your app: no account, no team membership, no saved sign-in, often on a phone. Each item names where apps that work for their owner break for that person, the fix in short, and the guide with the full steps.
Why it happens
The builder, the preview and your own account are all special. The preview address is approved for sign-in when the published one often is not, your address is on the project's team (the only kind Supabase's default sender delivers to), and your session is already signed in. The checklist is a list of the places where that special treatment ends.
The causes, and how to fix each
1. The live address loads for a stranger
Published and preview are different, and visibility settings can limit who opens the published link.
How to fix it
- Open the live address in a private window on a phone and on a computer.
- Lovable: audience Public in the Publish dialog. Base44: Public in the App Visibility drop-down in the Dashboard. Replit: production Secrets added in the Publishing pane.
Source: Lovable: Publish your project · Base44: Managing access and roles (app visibility) · Replit: Troubleshooting published apps
2. A new address can sign up and get the email
Supabase's default sender only delivers to your team, 2 messages an hour, and is not for production; its production checklist says to use custom SMTP for auth emails.
How to fix it
- Set up custom SMTP, then sign up with an address outside your team.
Source: Supabase: Send emails with custom SMTP · Supabase: Production checklist
3. The confirmation link opens your live app
The Site URL is the default place people are sent, and every redirect must be on the Redirect URLs list.
How to fix it
- Set the Site URL to your live address and add every address you use to Redirect URLs (Authentication, URL Configuration; on Lovable, More, Users, Settings, Advanced).
Source: Supabase: Redirect URLs · Lovable: Authentication (Site URL and redirect URLs)
4. The first real action saves something
Supabase's production checklist says to enable row-level security on all tables, with reasonable policies. With it on, a new user can save only what a policy allows.
How to fix it
- Add an insert rule for the people who should save data, then try it as a new user.
Source: Supabase: Production checklist
5. A stranger cannot see another person's data
Supabase says tables without row-level security and reasonable policies let any client read and change their data.
How to fix it
- Run Supabase's Security Advisor and fix what it flags (on Bolt: the Security page of the database settings; on Base44: Run Security Scan in the Dashboard).
Source: Supabase: Production checklist · Supabase: Performance and security advisors · Bolt: Database security · Base44: Running a security scan
6. Password reset and Google sign-in work for a new person
Reset links need a page to land on and an address on the redirect list; Google needs your live domain on its client.
How to fix it
- Request a reset for a new account and open the link on your live address.
- Sign in with a Google account that has never used the app.
Source: Supabase: Password-based auth (reset flow, redirect URL, no account disclosure) · Google Cloud: Manage OAuth clients (origins and redirect URIs)
Why you can't see it yourself
You're signed in, your customers aren't. Every item above is invisible from your own account. That is the reason to run it from the outside, as a stranger.
Frequently asked questions
What should I check before launching a vibe coded app?
That a stranger can open it, sign up with a new address, get the confirmation email, land back on your live app, save something, and not see anyone else's data. The items above link to the steps for each.
Is this a security audit?
No. It covers what a first customer meets. Supabase's production checklist and Security Advisor cover more of the database side.
Why does my app work for me but not for new users?
Your account, address and session are special: on the team, already confirmed and already signed in. A new person has none of that.
What does VibeFix check, and what not?
It signs up to your live app once as "VibeFix Test", with its own inbox, on a phone and a computer, and reports what a new user hits. It is not a load test, penetration test or code review, never changes your app and never emails your users.
Sources (official documentation)
- Lovable: Publish your project
- Base44: Managing access and roles (app visibility)
- Replit: Troubleshooting published apps
- Supabase: Send emails with custom SMTP
- Supabase: Production checklist
- Supabase: Redirect URLs
- Lovable: Authentication (Site URL and redirect URLs)
- Supabase: Performance and security advisors
- Bolt: Database security
- Base44: Running a security scan
- Supabase: Password-based auth (reset flow, redirect URL, no account disclosure)
- Google Cloud: Manage OAuth clients (origins and redirect URIs)
Related guides
- My builder says the app is tested, but my customers hit problems
- It works in the preview but breaks after I deploy
- Supabase confirmation email not sending: new users never get it (Lovable, Bolt, Base44)
- Supabase login not working on my published Lovable app (works in preview)
- Users can see other users' data in my Lovable app
- Is a secret key or admin page visible on my live app?
- Data won't save: "new row violates row-level security policy"
- Supabase reset password email not sending: why a customer clicks "Forgot password" and gets nothing
- Supabase redirect URL localhost: keep it for testing, send real users to your live app
VibeFix is independent. Supabase, Lovable, Bolt, Replit and Base44 are trademarks of their owners.
Fixed it? Prove a real stranger gets in
A fix that works from your own account proves nothing about a new customer. Your AI reads your code. VibeFix signs up like a stranger.
Free check. Paste your live app's link: an AI agent signs up to your live app once as a brand-new person ("VibeFix Test") with a real inbox of its own, on a phone and on a computer, and shows how many problems a new user still hits, what each one is, and one screenshot. No account needed. It never changes your app and never emails your users.
$9 for one app. If something is still broken, $9 tells you which of these causes is breaking your app and where, gives you a fix prompt written for your app, and includes 3 re-checks so you can see the result from the outside. It does not promise a fix; it shows what the agent saw.