Fails & Fixes
Real failures hit while building with AI tools, paired with verified fixes. Avoid the trap before you fall in.
Supabase Edge Functions require a valid JWT by default, which causes 401 errors when Stripe (or any external service) calls your webhook endpoint.
Vercel’s free Hobby plan prohibits commercial use. Running a paying-customer app on it violates terms of service and can result in suspension.
Deploying a React SPA to Cloudflare Pages without a `_redirects` file causes 404 errors on any route other than the homepage.
A “public bucket” in Supabase makes every stored file readable by anyone with the URL — including files uploaded by other users.
Stripe can deliver the same webhook event more than once. Without idempotency, your app may double-charge, double-provision, or double-send emails.
Enabling RLS on a Supabase table without adding any policies blocks all data access for real users — silently, with no error in your logs.
Using `auth.role()` instead of `auth.uid()` in a Supabase RLS policy makes every logged-in user able to read every other user’s data.
Enable provider, set redirect URLs, call signInWithOAuth.
Enable extension, create vector column.
Use .inputValidator((d) => Schema.parse(d)).
Mark file as do-not-edit in project rules.
Invalidate the parent list query after the detail mutation.
Missing <Outlet/> in _authenticated layout.
persistSession flag was off.
Add Access-Control-Allow-Origin and OPTIONS handler.
Return a Response with a TransformStream.
Step-by-step replacement of Routes/Route with file-based routing.
Forgot WITH CHECK on the insert policy.
Body parser ran before raw-body capture.
Variables without the VITE_ prefix never reach the browser bundle.
Dialog stayed mounted across routes.
Cursor and Lovable rebuilt the wrong file after a refactor; isolating the import map fixed it.
Use @theme inline mapping for shadcn token vars.
Forgot @source directive.
