Fixes for the errors AI-built apps hit on deploy day
8 guides. Each starts from the exact error, says why it happens, and gives a fix you can check, citing the official docs it relies on.
All fix guides
- 404 on refresh
A 404 on refresh of a deep route returns 404: NOT_FOUND on Vercel or "Page not found" on Netlify. Add one SPA rewrite to index.html.
404: NOT_FOUND (Vercel) / "Page not found" (Netlify) on any route except / - blocked by CORS policy: No 'Access-Control-Allow-Origin' header
Fix "blocked by CORS policy" when your front-end and API live on different domains: answer the OPTIONS preflight, allow your real production origin, and never mix * with cookies.
Access to fetch at 'https://api…' from origin 'https://yourapp…' has been blocked by CORS policy (Firefox: Reason: CORS header 'Access-Control-Allow-Origin' missing) - new row violates row-level security policy
Fix "new row violates row-level security policy" (Postgres 42501) in Supabase: add an insert policy, send user_id, and confirm a session.
new row violates row-level security policy for table "…" (code 42501) - No signatures found matching the expected signature
Fix "No signatures found matching the expected signature for payload": use the right whsec_ secret, verify the raw body, and check failed deliveries.
Webhook signature verification failed. Err: No signatures found matching the expected signature for payload. - redirects to localhost:3000
Sign-up or OAuth redirects to localhost:3000 after deploy. Set the Supabase Site URL and Redirect URLs to your production domain, and pass redirectTo.
Email link opens http://localhost:3000/#access_token=… (or "This site can’t be reached") - Replit publishing fails
Replit Preview works but publishing fails, or the live URL is broken. Listen on 0.0.0.0, add Secrets in the Publishing pane, and keep the homepage fast.
Publishing fails at the final step / the published replit.app URL errors while Preview works - supabaseUrl is required
Fix "supabaseUrl is required" in production: use the VITE_ or NEXT_PUBLIC_ prefix, set the vars on the host, and rebuild. Don't put secret keys in them.
Error: supabaseUrl is required. / import.meta.env.MY_KEY is undefined / process.env.MY_KEY is undefined in the browser - Lovable security scan vs a production review
Lovable's Quick scan, Deep scan and auto-fix compared with a free outside checker, a manual production review and a pentest, area by area: RLS, secrets, SPA routing, env vars, webhooks, CORS, headers, monitoring and free-tier limits.
