Your app breaks in production for a reason the preview never showed you: real users doing unpredictable things against infrastructure the AI never actually configured. The preview environment in tools like Lovable, Bolt or Replit is forgiving. Production is not. The good news is that the failure points are remarkably consistent, and almost all of them are fixable without starting over.
Here are the five we see most often, in the order we usually find them.
1. The Database Has No Rules
This is the most common and the most dangerous one. AI builders love Supabase and Firebase, but they frequently skip or misconfigure row level security. Everything works in testing because you are the only user. Then two real users sign up, and suddenly user A can see user B’s data, or a curious visitor can read your entire database from the browser console.
If your app stores anything private, this is the first thing to check. It is also the one that turns into a real liability if you ignore it.
The fix: an audit of every table and every access policy, then rules written for how the data is actually used. This is careful work, but it is bounded work. A typical app has a dozen tables, not a thousand.
2. Secrets Are Sitting in the Frontend
AI generated code has a habit of putting API keys where they do not belong. A payment key or an OpenAI key embedded in frontend code is visible to anyone who opens developer tools. We have seen builders discover this only after someone ran up charges on their OpenAI account.
The fix: move every secret server side, rotate the exposed keys, and add the small backend layer the AI skipped because the preview did not need it.
3. It Was Never Actually Deployed, Just Previewed
A preview URL is not a production deployment. Custom domains, environment variables, build settings, redirects and SSL are all things the preview handled for you invisibly. The moment you try to move to your own domain or your own hosting, the gaps appear: blank pages, broken auth callbacks, forms that submit to nowhere.
The fix: a real deployment pipeline, even a simple one. Your code in a repository you control, environment variables set per environment, and a hosting setup you can rebuild from scratch if the platform disappears tomorrow.
4. The AI Fix Loop Made It Worse
This is the pattern that brings most people to us. Something small breaks. You ask the AI to fix it. The fix breaks two other things. You ask again, and the app drifts further from working with every prompt while your credits drain. The codebase fills up with duplicate components, dead code and three different ways of doing the same thing.
This happens because the AI is patching symptoms without a mental model of the whole system. Past a certain size, every change it makes is a guess.
The fix: a human has to read the code, form that mental model, and untangle the duplication. In our experience most fix-loop apps are salvageable. The core idea is usually sound; it is the accumulated patches that need clearing out.
5. It Falls Over When More Than a Few People Use It
Queries that fetch the entire table and filter in the browser. Images uploaded at full size with no compression. No indexes on the columns everything sorts by. None of this matters with five test users. All of it matters with five hundred real ones, and the app that felt instant in the preview starts timing out.
The fix: measure first, then fix the two or three bottlenecks that actually matter. Performance work on small apps is mostly about removing obvious mistakes, not exotic optimization.
What This Means for Your App
If your app is stuck in one of these five failure modes, you do not necessarily need a rebuild, and you should be skeptical of anyone who leads with that. In most rescues we complete, the majority of the AI generated code stays. The work is auditing what exists, fixing the parts that were never production ready, and getting it deployed on infrastructure you own.
The order matters: security first, then deployment, then stability, then performance. Getting that sequence wrong is how a two week rescue becomes a two month one.
If you want a second set of eyes on yours, we do a free rescue assessment: you share access, we tell you exactly what state the app is in, what it needs, and what that costs. Honest answers either way, even if the answer is that you are closer to done than you think.
