Blog
Your app works. Now what?
Every article here answers one question a founder actually asked — about security, deployment, getting off the platform, or what the last stretch really costs. The answer is in the first two sentences. The rest is the detail behind it.
Who this is for
You built something with Lovable, Bolt, Cursor, Replit or Base44. It works. Now you are at the part nobody warned you about — the security warnings you cannot clear, the build that behaves differently once it is live, the export that will not export, the question of what the last stretch actually costs. Written by Muhammad Bilal, who fixes these for a living.
9 min read
Who can legitimately read my source code and my customers' data?
More than most people assume, and mostly by agreement rather than by breach. Your builder platform, your hosting provider, your editor's vendor and any AI service you connected all have some access, under terms you accepted. From 9 September 2026 one of them may use free and paid content for training unless you opt out.
Read the full answer13 min read
What should I ask before paying someone to build an AI agent for my business?
Ask what the agent can read, what it can be told by strangers, and where its output can reach. Those three together are the whole security question. Then ask what stops it costing you money in a loop, and what happens on the second identical run — because the failure mode is inconsistency, not a crash.
Read the full answer9 min read
Lovable moved to TanStack Start. What does that mean for my app, and should I migrate?
From May 2026 new Lovable projects use TanStack Start with server rendering on Cloudflare Workers instead of a browser-only React app. Existing projects stay on the old stack until you opt in. It fixes the search-engine problem, and it changes where the app can be hosted and which code runs on the server.
Read the full answer8 min read
What happens if my AI app platform suspends my account? Can I lose my app and my customers' data?
Your code survives if it is in a repository you own. Your data usually does not, because on a builder-managed backend the only credentialed path to the database is the account that was just suspended. There is rarely a human to appeal to. The defence is owning the database separately, from day one.
Read the full answer9 min read
Are my API keys exposed in my GitHub repository or in my published site?
Two different places, two different answers. A key in your repository is exposed if the repository is public, and stays exposed in the history after you delete the file. A key in your published site is exposed if the build inlined it, which happens by design to anything named for client use. Neither produces an error.
Read the full answer9 min read
My app stopped working and I have not changed anything. What could have expired?
Something with a clock on it. Sign in with Apple's client secret expires at six months. Certificates, domains, card details, API versions and platform deprecations all have dates attached. Nothing in your code changed, which is exactly why it is hard to find — the change happened on a calendar somewhere else.
Read the full answer7 min read
Supabase paused my project and my app stopped working. Is my data gone?
No, it is paused rather than deleted, and you can restore it from the dashboard. The part worth knowing is that free projects pause after a period of low activity, that ordinary API traffic does not always seem to count as activity, and that a paused project does not stay restorable forever.
Read the full answer8 min read
My live Lovable app stopped working and it says I am out of credits. Why does that take my app offline?
Since June 2026 Lovable draws build and runtime spend from one balance, and the database is billed as a continuously running instance rather than by traffic. At zero the backend pauses, which takes your live app down — and by Lovable's own documentation you cannot export your data while it is paused.
Read the full answer13 min read
My Stripe checkout works and money is arriving. What else do I actually need to handle?
Checkout is the easy part and AI tools build it well. What is usually missing is everything after: the webhook that grants access when the customer closes the tab, the duplicate guard, the failed-payment path that should revoke access, and the signature check. None of it errors. It quietly leaks money and free accounts.
Read the full answer13 min read
Why can one of my users see another user's data even though everyone has to log in?
Because logging in and being allowed are two different checks. Authentication asks who you are; authorization asks what you may touch. AI coding tools reliably build the first and routinely skip the second, so a logged-in user who changes an id in a request often gets somebody else's record back.
Read the full answer11 min read
Which AI coding platform is best for an app that has to run in production?
They are not really four of the same thing: three host your app and one is an editor that hosts nothing. For production the question is who owns the security boundary and what tooling exists to check it — and the platform with the worst public incident history now ships the most thorough scanning.
Read the full answer9 min read
How do I find and hire the right developer to fix my AI-built app?
Hire for the specific work, not for a role. Ask for a fixed-scope review before any build agreement, watch for the one red flag that matters — anybody who opens with 'rebuild it properly' before reading your code — and make sure you own the accounts, the repository and the deployment at the end.
Read the full answer9 min read
If AI can build my app, do I still need to hire a developer?
For building, increasingly no — AI genuinely gets you a working product. For shipping something that takes money and holds other people's data, usually yes, but not full-time and not forever. The work that still needs a person is a bounded list, and most of it is judgement about consequences rather than typing.
Read the full answer10 min read
How do I move my app from Lovable Cloud to my own Supabase project?
Lovable Cloud is a Lovable-managed Supabase project you have no dashboard for, no connection string to, and no service_role key from. Migrating out means exporting the database through Lovable's own export, rebuilding what the export leaves behind — storage files, edge functions, secrets — and planning for password resets.
Read the full answer10 min read
If I export my app from Lovable, Bolt or Replit, what do I actually get?
The code, almost always. The database, sometimes, and only through a specific export path. Your storage files, your edge functions and your secrets, usually not at all. And on every platform the export is a feature of an account in good standing rather than a right, which is the part worth planning around.
Read the full answer10 min read
My AI-built app is down and I don't know why. What do I do first?
Do not start changing things. Spend the first ten minutes establishing what is actually broken and for whom, check the external status pages before touching your own code, then roll back rather than fix forward. Most incidents in AI-built apps are a deploy, a limit, an expired credential or the vendor — in that order.
Read the full answer9 min read
What does it cost to run an AI-built SaaS app in production in 2026?
About $70 to $115 a month in fixed subscriptions once the app takes real money: a database plan with backups, hosting on a plan that permits commercial use, error tracking and transactional email. Payment fees sit on top and scale with revenue — and the European rate is roughly half the American one.
Read the full answer10 min read
Should I fix my AI-built app or rebuild it from scratch?
Rebuild only when the data model is wrong at the root, or when the platform cannot give you what you need. Everything else — messy code, missing security, no tests, slow queries — is repair work, and repair is usually cheaper because it keeps the part that already works: your live users and your real data.
Read the full answer9 min read
Why does my AI-built app slow down or break once real users start using it?
Your app was tested by you against fifty rows, and three things that are invisible at that size become severe at a real one: queries that load everything, a database call inside a loop, and no indexes. Add concurrency, uploads and free-tier ceilings, and the app does not crash — it gets slowly unusable.
Read the full answer12 min read
Why is my AI-built app stuck at 80% and what does finishing it actually involve?
The last 20% is not more features. It is the invisible work — the security boundary, the failure paths, the operational scaffolding — that the AI was never asked to build and cannot verify. It is a finite list rather than a mystery, and no amount of further prompting substitutes for going through it.
Read the full answer12 min read
Why does my app work in preview but break in production?
Six things differ between the two environments, and none of them announce themselves: the environment variables, the allowlists that still name your preview URL, an unverified email sending domain, a database that is not the same database, caching that only exists in production, and a production build that is stricter than the dev server.
Read the full answer17 min read
What actually goes wrong when an app built with Lovable, Cursor, Bolt or Replit goes to production?
Almost always the same ten: no row-level security, secrets readable in the browser or in git, no check on what a logged-in user may touch, preview-versus-production drift, queries that collapse under load, no error alerts, untested backups, payments wired only to the happy path, code nobody can safely change, and a platform you do not fully own.
Read the full answer8 min read
Is my Lovable app secure, and how can I check it myself?
Open your live app, press F12, and watch the Network tab while a page loads your data. If a response contains rows belonging to other users, your database has no working row-level security and anyone can read that data with a browser.
Read the full answerNew articles as they are written · Subscribe by RSS
Stuck on the thing you just read about?
Send me a screenshot of what you are seeing. I will tell you whether it is serious, free, with no pitch attached.
Ask me on WhatsApp