Production readiness self-check
Run nine evidence-based checks against a repository and get a scored summary, release blockers, and the next useful action.
Use this resourceFix Library · 29 practical guides
Find the issue.
Follow the fix.
Production troubleshooting for AI-built apps. Find the issue in Lovable, Replit, Supabase, v0, Firebase, Cursor, Claude Code, Next.js, or Stripe, then verify the repair in your app.
Specific symptoms · Concrete repairs · Verification steps
Start with what you can see
A guide for the issue in front of you.
Choose the closest symptom. Each guide explains the failure, the code or configuration to change, and the checks that prove the repair worked.
Preview and deployment
Preview works, but the published app fails, stays blank, or cannot start.
Base44Base44 app shows a blank screen or does not load
Check the failing published request, integration settings, and browser or platform errors.
LovableLovable app shows a blank or white screenTrace the first render failure through browser errors, build output, and missing configuration.
LovableLovable app works in preview but not after publishingCompare published environment settings, authentication origins, and production API responses.
ReplitReplit app shows a blank or white screen after deploymentFind the first browser error and check the deployed JavaScript, API calls, and asset paths.
ReplitReplit app works in preview but fails after deploymentCompare deployment settings, production secrets, runtime commands, and the live data path.
ReplitReplit deployment failed with a health check or port errorCheck the start command, server binding, expected port, and deployment health response.
Login and data access
Login, permissions, database rules, missing rows, and records that do not save.
Claude Code web appClaude Code web agent accepts anonymous runs: secure the agent API boundary
Check sessions, conversation ownership, and tool permissions before starting agent work.
Firebase StudioFirebase Studio admin page is hidden, but are Firestore rules protecting the data?Test deployed rules and admin claims against direct owner, cross-user, and ordinary-user requests.
Lovable + SupabaseLovable and Supabase data is not savingInspect the rejected write, schema, authenticated user, and applicable database policy.
Lovable + SupabaseLovable and Supabase login or signup not workingTrace session creation, callbacks, provider settings, and the app’s login state.
Replit + ExpressReplit API routes work without login: how to fix missing authenticationRequire server authentication and record ownership before private reads or writes.
Replit + ExpressReplit app has a default admin password or session secret: what to fix firstRemove fixed fallback credentials, require deployment secrets, and guard admin actions.
SupabaseSupabase “new row violates row-level security policy” errorMatch the write, caller identity, and ownership fields to the effective INSERT policy.
Supabase AuthSupabase OAuth redirects to localhost or the wrong URLAlign production callback URLs, provider settings, and the allowed redirect list.
SupabaseSupabase returns an empty array although data existsSeparate filters and environment mismatches from rows hidden by database access policies.
Supabase StorageSupabase Storage 403 unauthorized or RLS upload errorCheck bucket paths, caller identity, and the Storage policies required for the operation.
Payments and subscriptions
Stripe signatures, paid access, price mapping, and subscription cancellation.
Stripe subscriptionsStripe checkout price and app plan do not match: secure subscription tiers
Map the verified paid Price ID to an approved tier using a server-owned catalog.
Stripe + app accessStripe payment succeeded, but the app still shows a free plan or locked itemTrace verified payment events through durable processing, user mapping, and access records.
Stripe subscriptionsStripe subscription cancelled, but the app still shows paid accessDistinguish scheduled cancellation from ended access and reconcile subscription state.
Stripe + ExpressStripe webhook signature verification failed in Express: check the raw bodyPreserve the raw body and verify with the signing secret for the exact endpoint.
Exposed keys and secrets
Database and provider credentials that reach the browser bundle.
Next.js + GeminiGemini API key exposed in frontend code: how to secure AI calls
Rotate the key and move paid generation behind authenticated server-side usage controls.
Next.js + DrizzleNext.js database URL exposed in the browser: what to do nowRotate the exposed credential and move database access out of the client import graph.
Unsafe URLs and files
Server proxies, headless browser requests, and uploaded document previews.
Cursor + PuppeteerCursor-built Puppeteer scraper accepts any URL: how to secure browser fetching
Restrict navigation, redirects, secondary requests, and the browser worker’s network access.
DOCX + ReactDOCX preview renders unsafe HTML: secure uploaded Word documentsAuthorize file access, sanitize converted HTML, and test the actual preview renderer.
v0 + Next.jsv0 Next.js API proxy fetches a user-supplied URL: how to fix the SSRF riskReplace arbitrary proxy URLs with approved upstream actions and blocked-destination tests.
AI and developer tools
AI usage limits, Edge Functions, MCP connections, and codebase indexing.
Claude CodeClaude Code MCP server failed to connect
Check the server command, transport, credentials, logs, and connection lifecycle.
CursorCursor codebase indexing is stuck or not workingCheck workspace access, exclusions, project size, and indexing status before restarting.
Lovable + SupabaseLovable Edge Function returns a CORS or 500 errorSeparate preflight failures from function errors, missing secrets, and upstream responses.
v0 + AI APIsv0 AI API has no rate limit: prevent unexpected OpenAI or ElevenLabs costsEnforce request bounds, shared quotas, and a budget stop before paid provider calls.
The Verdict
Know how far the problem goes.
We can see the symptom from here. What we cannot tell you from outside is whether it is contained or structural. A scanner collects evidence. A named senior engineer makes the decision. For $299, a named senior engineer reads your code and signs a written Verdict against the nine checks in the Zenveus Production Readiness Standard. The 48-hour clock begins when the required access and context are available. If the report does not give your developer a list they can act on, you do not pay.