Fixes & Rescues
The 12 Bugs Every AI-Built App Has
RLS lockouts, white screens, broken OAuth, and nine other bugs that show up in almost every Lovable, Bolt, or Replit app we've audited. Check yours against this list.
Across every audit we've run on AI-built apps, the same handful of bugs show up again and again, almost regardless of which tool generated the code. Here are the 12 most common, what causes each one, and how to check if your app has it.
1. Supabase RLS lockouts
Row Level Security policies written for a simpler version of your schema stop matching reality as the schema grows, silently denying access to data that should be visible. Check for it: create a second test account with a different role and see what it can't access that it should.
2. Broken Google / Apple OAuth in production
Sign-in works in preview and fails on your real domain because the redirect URI registered with the OAuth provider only covers the preview URL. Check for it: try signing in on your actual production domain, not the builder's preview link.
3. Stripe webhooks that silently don't fire
A payment succeeds, but your database never updates, because the webhook endpoint, signing secret, or event subscription is misconfigured. Check for it: look at your Stripe dashboard's webhook logs for failed delivery attempts — most apps never check this.
4. White screens with no visible error
An unhandled exception in a component with no error boundary blanks the whole screen instead of failing gracefully. Check for it: open your browser console while using the app — errors that never surface in the UI show up there.
5. Environment variables mixed between preview and production
The deployed app quietly points at a preview database, API key, or third-party service because environments were never fully separated. Check for it: compare your production environment variables line by line against what the preview uses.
6. No error handling around external API calls
A third-party API timing out or returning an unexpected shape crashes the feature instead of failing gracefully. Check for it: temporarily disconnect your internet mid-action and see what the app does — most AI-generated code assumes the network always works.
7. Duplicated logic across components
The same validation, formatting, or calculation logic copy-pasted in multiple places, with only some copies getting updated when the rule changes. Check for it: search your codebase for the same string or number appearing in more than two files.
8. Missing database indexes on frequently queried columns
Queries that felt instant with ten test rows get slow with ten thousand real ones, because indexes were never added. Check for it: if a page has gotten slower as your user base grew, this is usually why.
9. No rate limiting on public endpoints
Signup, login, and contact-form endpoints with no limit on repeated requests, which is both a cost risk and a security gap. Check for it: this one's invisible until it's exploited — worth checking proactively, not waiting for a symptom.
10. Inconsistent loading and error states across screens
Three different patterns for "loading" and "something went wrong" across the app, because each was generated in a different session. Check for it: click around quickly on a slow connection and watch how inconsistently each screen behaves.
11. Client-side-only validation on sensitive actions
A form validates input in the browser but not on the server, so a direct API call can bypass it entirely. Check for it: this is a security check, not a UI check — worth having an audit look at your server-side validation specifically.
12. No monitoring, so you find out about bugs from users
Without error tracking or logging, the first sign of a bug is a confused or frustrated user, not an alert. Check for it: if your only bug-detection method today is "someone complains," this is the gap.
How many of these does your app have?
If you counted three or more, that's a normal result for an AI-built MVP that hasn't had a dedicated cleanup pass — it doesn't mean the app is a lost cause, it means it's due for one. A code audit checks for all 12 of these specifically, plus whatever else is unique to your codebase, and gives you a fixed quote to address what matters most first.
Stuck on this?
Get a code audit — 48 hours, fixed price ($199). A written report on what's broken, what's salvageable, and a fixed quote to fix it.