It worked perfectly in preview. Then you connected your own domain, sent the link to ten customers, and three of them couldn't log in.
If you've built an app on Lovable, Emergent, Bolt or Replit, you've probably met this moment. The AI got you 80% of the way in a weekend. The last 20% is where it stalls.
That isn't a sign that vibe coding is bad. It's a sign that the problems change once real people use your app. In preview, everything runs in one place the AI controls. Live, your app depends on your domain, your login service, your database rules, your payment gateway and your email. Most vibe-coded app problems live in those settings, outside the code the AI can see.
Over 16 years of building products, I've seen the same handful of launch problems again and again. AI-built apps hit them too, and eight come up most. Here's each one in plain English: what you'll notice, why it happens and how to fix it.
Disclosure: my studio runs Reset Tasks, which fixes exactly these problems for ₹2,000 each. I've marked which ones you can usually fix yourself.
1. Login works in preview, but breaks on your domain
What you'll notice: people can sign up, but when they log in or click a magic link, they land back on the login page. Or Google sign-in shows an error about a "redirect".
Why it happens: your login service (usually Supabase, which Lovable and many other tools use underneath) keeps a list of web addresses it's allowed to send people back to. In preview, that's the preview address. When you move to your own domain, nobody adds the new one to the list, so the login service refuses.
How to fix it: in your login service's settings, set the site address to your live domain, and add every version of it to the allowed redirect list: with and without "www", and any preview addresses you still use. If you use Google sign-in, add the same addresses in your Google Cloud settings too.
Can you do it yourself? Often, yes, if you can find the settings. It's one of the most common launch problems, and it takes about 20 minutes for someone who knows where to look.
Picture Rohan, who runs a coaching institute in Pune. He spends three evenings and 60 Lovable credits prompting the AI to "fix login". The AI keeps changing the code. The code was never the problem: one address was missing from one list.
2. Your database is open to anyone
What you'll notice: usually nothing, which is what makes it dangerous. Your app works. But anyone who knows how to look can read, and sometimes change, every row in your database: names, phone numbers, orders.
Why it happens: tools like Supabase protect data with row-level security: rules that say who can see which rows. If those rules are switched off, or written too loosely, the database answers anyone who asks. AI tools don't always set them up correctly.
This isn't theoretical. In 2025, a security researcher scanned 1,645 apps built on Lovable and found about 170 with databases that unauthenticated visitors could read (Matt Palmer). The issue was logged as CVE-2025-48757. Lovable added a security scanner afterwards, but a scanner can tell you rules exist without telling you they're right.
How to fix it: turn on row-level security for every table, and write a rule for each one: who can read it, who can add to it, who can change it. Then test it: log in as one customer and check you can't see another customer's data.
Can you do it yourself? Turning it on, yes. Writing the right rules takes some care. A wrong rule either leaks data or locks out your own users.
This matters legally too. Under India's DPDP Act, you're responsible for protecting your customers' personal data, even if a tool built the app. Here's what the DPDP Act means for your app.
Not sure whether your app's data is locked down? Reset Tasks will check your database rules and fix what's open, for a fixed ₹2,000. Money back if we can't.
3. Secret keys are sitting in the browser
What you'll notice: again, nothing, until a bill arrives. An OpenAI bill for ₹40,000 you didn't run up, or a payment account doing things you didn't ask for.
Why it happens: your app talks to other services using keys: long passwords for an AI model, a payment gateway or an email service. Some keys are meant to be public. Others, such as your payment gateway's secret key or your AI model key, must stay on a server. AI tools sometimes put them in the part of the app that runs in the visitor's browser, where anyone can open the page source and copy them.
How to fix it: move secret keys into server-side settings (often called "environment variables" or "secrets"), and make the app call those services from a server function, not from the page. Then replace the old keys. Once a key has been public, assume someone has it.
Can you do it yourself? Replacing a key, yes. Moving the calls to the server usually needs a developer.
4. Payments succeed, but orders don't
What you'll notice: customers pay, the money arrives in your Razorpay or Cashfree account, but the order in your app still says "pending", or the customer sees an error.
Why it happens: most apps don't decide a payment worked just because the customer came back to the page. They wait for the payment gateway to send a message to the app confirming it. That message is called a webhook. If the webhook address isn't set up in your gateway's dashboard, or the app doesn't check it properly, orders never get confirmed.
Two other causes are common:
- Test keys still in use. The app works with test cards, then fails with real ones because it's still using test-mode keys.
- Account not activated. Indian gateways need your business details and documents checked before they accept live payments.
How to fix it: switch to live keys, add your webhook address in the gateway dashboard, and make the app confirm orders from the webhook, checking its signature so nobody can fake one.
Can you do it yourself? The keys and account activation, yes. The webhook usually needs a developer. If you're still choosing a gateway, here's Razorpay vs Cashfree vs PayU for a small business.
5. Emails land in spam, or don't arrive
What you'll notice: customers say they never got the sign-up link, the password reset or the order confirmation.
Why it happens: there are usually two causes:
- The built-in email service has low limits. Supabase's default email sender is meant for testing, with a small hourly limit. Real apps need their own email service.
- Your domain isn't set up to send email. Email providers check three records on your domain (called SPF, DKIM and DMARC) to confirm the email really comes from you. Without them, your mail looks like spam.
How to fix it: connect a proper email-sending service, send from an address on your own domain, and add the three records your email provider gives you to your domain's settings. Here's how to set up business email on your own domain, which covers the same records.
Can you do it yourself? Yes, if you're comfortable editing your domain settings. Copy each record exactly.
6. The app breaks on phones
What you'll notice: it looks great on your laptop. On a customer's phone, buttons overlap, text runs off the screen, or a form can't be submitted because the keyboard covers the button.
Why it happens: AI tools design on a large screen by default. Most of your customers in India are on mid-range Android phones with smaller screens, older browsers and patchy networks.
How to fix it: test every important screen on a real mid-range Android phone, not just your own. Note each problem with a screenshot and fix one at a time, starting with sign-up and checkout.
Can you do it yourself? Often, with clear prompts and screenshots. "The 'Pay now' button is hidden behind the keyboard on this screen" works far better than "fix mobile".
7. Pages load slowly
What you'll notice: the home page takes five or six seconds to appear on mobile data. People leave before it loads.
Why it happens: AI-built apps often load everything at once: large images, every screen's code and several fonts. On fast office Wi-Fi it feels fine. On a 4G connection in a crowded market, it doesn't.
How to fix it: shrink and compress images, load images only when they scroll into view, and remove fonts and libraries you don't use. A free Website Health Check will show you how fast your live site is on mobile and what's slowing it down.
Can you do it yourself? Images, yes. The rest usually needs a developer.
8. Google and WhatsApp can't read your pages
What you'll notice: your app doesn't show up on Google. When you share a link on WhatsApp or LinkedIn, the preview is blank or shows the wrong title.
Why it happens: many AI-built apps are "single-page apps". The page arrives nearly empty, and the browser fills it in with code. Google can often handle that, but slowly. WhatsApp and LinkedIn link previews usually can't, so they see only the empty shell.
How to fix it: give each important page its own title, description and preview image in the page itself, and make sure your public pages (home, pricing, about) can be read without running the app's code. Add your site to Google Search Console so you can see what Google sees.
Can you do it yourself? The titles and descriptions, often yes. Making public pages readable without code usually needs a developer.
One more: you have no backups
On Supabase's free tier, there are no automatic backups, and projects pause after a week with no activity (Supabase). That's fine while you're testing. Once real customers depend on your app, upgrade to a plan with daily backups, or set up your own.
Is vibe coding bad, then?
No. For getting a first version in front of real users, it's often the best option available. An owner can now test an idea in a week that would once have needed an agency, three months and a few lakh rupees.
The risk isn't the AI. It's assuming that "works in preview" means "ready for customers". Testing belongs at the start, not after launch, and that's as true for AI-built apps as for any other. Here's why testing belongs at the start, even with AI.
Picture Sana, who sells skincare from Hyderabad. She builds an order app on Emergent and shares it with her 300 regular customers before checking any of the eight items above. Within a day, two customers report seeing each other's orders. She takes the app down for a week. If she had checked her database rules first, it would have taken an afternoon.
Before you launch: a 10-minute checklist
Run through this before you share your app with real customers:
- Log in on your live domain, on a phone, using every sign-in option you offer
- Log in as one customer and try to see another customer's data
- Open the page source and search for "key" or "secret"
- Make a real payment of ₹1 and check the order updates
- Sign up with a new Gmail address and check the email arrives in the inbox
- Open every key screen on a mid-range Android phone
- Load the home page on mobile data and time it
- Share your link on WhatsApp and check the preview
- Confirm your database has backups
- Confirm the domain, database, code and payment accounts are in your name
If any of these fail and the fix isn't obvious, that's a good moment to stop prompting.
Frequently asked questions
Why does my Lovable app work in preview but not on my domain?
Usually because your login service doesn't have your new domain on its list of allowed addresses. Add the live domain (with and without "www") to your login service's site address and redirect settings, and to Google's settings if you use Google sign-in.
Is vibe coding safe?
It can be, but AI tools don't make apps secure by default. The two biggest risks are databases without access rules and secret keys exposed in the browser. Check both before real customers use your app.
What is row-level security in Supabase?
Rules that decide which rows in a database table each user can read or change. Without them, anyone with your app's public database address can read your data. Turn them on for every table and test them.
Why do my app's emails go to spam?
Usually because your domain is missing the email records (SPF, DKIM and DMARC) that prove the email comes from you, or because the app still uses a built-in test email service. Use a proper sending service and add the records.
Can the AI fix these problems itself?
Some, like mobile layout, if you prompt clearly. Most of the others live in settings outside the app's code (your domain, login service, payment gateway and email), which the AI can't see. That's why prompting often goes round in circles.
How much does it cost to fix a problem in an AI-built app?
If you do it yourself, nothing but time. A freelancer might charge anything from ₹1,000 to ₹10,000 depending on the problem. Reset Tasks fixes one problem for a fixed ₹2,000, with a money-back guarantee.