2026-10-12
Preview builds hide the failures that show up once real users, real data, and a real deploy pipeline are involved.
Lovable, Bolt.new, Cursor, and v0 optimize for a working screen. The generated app usually runs with a permissive database, a single admin user, and no concurrency. That is enough for a demo and not enough for a launch.
The first production failures are boring: environment variables that exist locally and not on Vercel, a service-role key compiled into a client bundle, and a query that was fine on 40 rows and times out on 40,000.
Authentication state is often checked in the browser and trusted by the server. Row Level Security is disabled, or a policy uses a column the client can set. Server Actions then run with more privilege than the logged-in user.
Performance follows the same pattern. Nested server components each open their own query. There is no index for the filter, no timeout, and no idempotency key on the webhook that charges a card.
A rewrite is usually the wrong first move. The UI and the workflow are the part the founder already validated. The work is to put authorization in the database, stop leaking secrets, and make the hot path one query.
A production audit should name the failing policy, the query plan, and the deploy setting. A rescue engagement should ship those fixes as pull requests with a way to prove they worked.