$ npm run dev # works. ship it # doesn't.
Your AI-built app works on localhost.
I get it to production.
You built it with Lovable, Bolt, Cursor or Claude Code. Then the deploy fails, login breaks, or Supabase lets strangers read your tables. I'm Nhat Phan. I run production systems every day, and I run every repo before I write about it.
The first look is free while I build case studies. You get a written note, not a sales call.
What usually breaks
deployBuilds locally, fails on Vercel, Netlify or a VPS. Env vars, build output, ports, server functions.authLogin works in dev, loops or 401s in production. Redirect URLs, cookies, session expiry.supabaseRow level security off or wrong, so any visitor can read or edit other people's rows.stripeCheckout takes the money, but the webhook never reaches your app, so the user never gets access.leaked keysSecret keys shipped in the browser bundle or committed to Git. Rotate first, then fix.
How I work
- You send the repo and one sentence on what breaks.Private repo access or a zip is fine.
- I read the code and run it.Same way I test every tool I write about: in a sandbox, with real numbers.
- You get a short written note.The two or three things that will hurt you first, and exactly how to fix them.
- If you want, I fix them.You keep the code, the access and the decisions.
What a check looks like
✓ https redirect, HSTS
✗ /.env is publicly readable
✗ supabase anon key in bundle, RLS not enabled on 2 tables
✓ stripe publishable key only, no secret key in client
✗ contact form has no rate limit or captcha
✗ /.env is publicly readable
✗ supabase anon key in bundle, RLS not enabled on 2 tables
✓ stripe publishable key only, no secret key in client
✗ contact form has no rate limit or captcha
Illustrative example. Every real report only contains what I actually found.