FILTER · ALL
FILTER
Notes
Templates, build notes, AI dispatches and fixes for apps built with AI. Whatever the piece promises is on the page in full: no signup, no gate, nothing held back for later.
START HERE
Built it with AI and it's breaking? Start with these three.
Your Lovable app's Supabase tables are readable by anyone: how RLS works and how to check yours
Turn on row-level security for every table in the public schema, then write policies that compare auth.uid() to the row's owner. Never using (true).
OPEN →Users sign up, then can't log in: the six ways Supabase auth breaks in AI-built apps
Handle unconfirmed users on purpose, send auth email through your own SMTP, point Site URL and Redirect URLs at your real domain, and create profile rows with a security definer trigger on auth.users instead of from the browser.
OPEN →Works locally, breaks on Vercel: the five reasons a Lovable or Cursor app fails in production
Add every VITE_ variable in Vercel's project settings and redeploy, rewrite unknown paths to index.html, match import casing to file names exactly, build to dist, and add your real domain to Supabase's redirect URLs.
OPEN →- RESOURCE DROP4 MIN READ
Zero to builder: a 30-day AI roadmap for complete beginners
USE WHENYou're curious about AI, have no coding background, and don't know what day one even looks like.
YOU GET
A 30-day, one-task-a-day AI roadmap and a two-page printable PDF
ON PAGE + PDFVERIFIED 02 OCT 2026 - BUILDER WISDOM3 MIN READ
AI agents just hacked 395 organisations in hours: "nobody's attacked me yet" is no longer a defence
USE WHENYou run anything reachable from the internet and your plan for updates is "when I get round to it".
THE TRADEOFF
Patching fast means sometimes shipping an update that breaks something, and automatic updates occasionally do. You're choosing the risk of a bad update, which you can roll back, over the risk of a breach, which you can't. Pulling tools off the public internet also makes them less convenient for you. That's the point, but you'll feel it.
VERIFIED 29 SEPT 2026 - BUILDER WISDOM3 MIN READ
Your AI feature can change without you touching the code: pin the model, then keep rechecking it
USE WHENYou shipped a feature that calls an AI model, tested it once, and haven't looked at its answers since.
THE TRADEOFF
Pinning means you don't get improvements for free, and pinned versions get retired, usually with a deadline. You're swapping surprise changes for scheduled upgrade work. That's the right swap, but it is work, and someone has to own the calendar.
VERIFIED 29 SEPT 2026 - RESOURCE DROP4 MIN READ
AI jargon decoder: 25 AI words explained in plain English
USE WHENSomeone says "token", "context window" or "RAG" in a meeting and you nod along.
YOU GET
A 25-term plain-English AI glossary and a one-page PDF
ON PAGE + PDFVERIFIED 29 SEPT 2026 - RESOURCE DROP5 MIN READ
The AI context file template: stop re-explaining your project to every new chat
USE WHENYou open a new AI chat and spend the first five minutes explaining your project again.
YOU GET
A 5-part context file template, a worked example, and the PDF
ON PAGE + PDFVERIFIED 25 SEPT 2026 - BUILDER WISDOM7 MIN READ
Before real users touch your AI-built app: the production checklist
USE WHENYou built an app with Lovable, Bolt, Cursor or v0, it works in the preview, and you're about to send the link to people who aren't you.
THE TRADEOFF
Working through this properly takes a day or two, and none of it shows up as a feature. It will feel like stalling right when you most want to launch. The alternative is finding out about each of these from a user, and a few of them, the security ones especially, can't be undone once someone else has found them first.
VERIFIED 24 SEPT 2026 - FIXES6 MIN READ
Every new prompt fixes one thing and breaks two others: why AI-built apps regress, and how to stop the loop
USE WHENYour app was built with Lovable, Bolt, Cursor or Claude Code, and every fix you ask for quietly breaks something that used to work, so you're spending more time re-fixing than building.
THE FIX
Stop prompting forward from a broken state: revert to the last good checkpoint, ask for one named change at a time with what must not change, and put a signup-to-core-action smoke test between every change and every deploy.
VERIFIED 24 SEPT 2026 - FIXES5 MIN READ
Why Google and ChatGPT can't see your Lovable app, and how to fix it
USE WHENYour app built with Lovable, Bolt or v0 is live, but it doesn't show up in Google, AI assistants don't know it exists, and shared links show a generic preview.
THE FIX
Prerender your public pages to real HTML at build time, give each one its own title, description and preview tags, then publish a sitemap and submit it in Search Console.
VERIFIED 24 SEPT 2026 - FIXES5 MIN READ
Your Lovable app's Supabase tables are readable by anyone: how RLS works and how to check yours
USE WHENYour app was built with Lovable, Bolt or Cursor on Supabase, it has real users, and nobody has ever read its row-level security policies.
THE FIX
Turn on row-level security for every table in the public schema, then write policies that compare auth.uid() to the row's owner. Never using (true).
VERIFIED 24 SEPT 2026 - FIXES7 MIN READ
Users sign up, then can't log in: the six ways Supabase auth breaks in AI-built apps
USE WHENPeople can create an account in your Lovable, Bolt or Cursor app, but logging in fails, the confirmation email never shows up, or they're logged out every time they refresh.
THE FIX
Handle unconfirmed users on purpose, send auth email through your own SMTP, point Site URL and Redirect URLs at your real domain, and create profile rows with a security definer trigger on auth.users instead of from the browser.
VERIFIED 24 SEPT 2026 - FIXES6 MIN READ
Your Supabase service_role key is in your frontend: how to check, what to do first, and the real fix
USE WHENYour app talks to Supabase from the browser, and somewhere in its code or its environment variables there's a key with service_role or sb_secret_ in it, or you can't say for certain that there isn't.
THE FIX
Replace the leaked secret key in Supabase's API keys settings, update it on your server only, strip it from client code and git history, check the logs, then move the privileged work into an Edge Function and fix RLS so the public key is enough.
VERIFIED 24 SEPT 2026 - FIXES5 MIN READ
Works locally, breaks on Vercel: the five reasons a Lovable or Cursor app fails in production
USE WHENYour app runs fine on your laptop or in the Lovable preview, and the deployed version is a blank page, a 404, a failed build or a login that bounces to localhost.
THE FIX
Add every VITE_ variable in Vercel's project settings and redeploy, rewrite unknown paths to index.html, match import casing to file names exactly, build to dist, and add your real domain to Supabase's redirect URLs.
VERIFIED 24 SEPT 2026 - BUILDER WISDOM5 MIN READ
Adding AI to an existing product: the architecture mistake that costs you twice
USE WHENSomeone has asked for an "Ask AI" button on a product that already exists, and you're about to start at the button.
THE TRADEOFF
Doing this properly means two or three weeks where there is nothing to demo. You build a boring retrieval layer while a competitor ships an Ask AI button, and no stakeholder can see your progress. The bill arrives later either way, and this just decides who pays it.
VERIFIED 30 AUG 2026 - BUILDER WISDOM4 MIN READ
How to tell if a product is just an AI wrapper: three questions, ten seconds
USE WHENYou are evaluating an "AI-powered" tool, or deciding whether the thing you're building is one.
THE TRADEOFF
This test disqualifies plenty of things worth building. A wrapper shipped in a weekend that solves a real problem beats a defensible architecture that ships in a year, and this test will tell you to build the second one.
VERIFIED 29 AUG 2026 - DISPATCH3 MIN READ
Claudeforce: Salesforce put Claude inside its trust boundary, and itself inside Claude
USE WHENYou were planning to build something that sits between a CRM and a model.
LEAD ITEM
Claude is now the default reasoning model across Agentforce
+2 MOREVERIFIED 29 AUG 2026 - DISPATCH3 MIN READ
GLM-5.3-Flash: a 1M-context multimodal model under MIT at $0.15 per million
USE WHENYou priced part of your product against a frontier API more than six months ago.
LEAD ITEM
"Ox Alpha", free, 1M context, no claimed owner, was GLM-5.3-Flash all along
+2 MOREVERIFIED 29 AUG 2026 - DISPATCH3 MIN READ
OpenAI retired o3 from ChatGPT, and the API is on a completely different clock
USE WHENYou have a model name written as a string literal somewhere in your codebase.
LEAD ITEM
o3 left ChatGPT on 26 August, ending a 90-day sunset announced on 28 May
+2 MOREVERIFIED 29 AUG 2026 - DISPATCH3 MIN READ
OpenAI's agent containment report: read it as a blast-radius argument, not an alignment one
USE WHENYou are about to give an agent real credentials to a system you care about.
LEAD ITEM
The escape itself was July, and it isn't the new part
+2 MOREVERIFIED 29 AUG 2026 - RESOURCE DROP
100 AI prompts that actually work: the four-part anatomy behind them
USE WHENYou are getting vague answers out of Claude or GPT and can't tell whether the model or the prompt is the problem.
YOU GET
100 copy-paste prompts in 5 categories, plus the PDF
ON PAGE + PDFVERIFIED 29 AUG 2026 - RESOURCE DROP5 MIN READ
n8n standup automation: auto-generate a daily standup from Linear into Slack
USE WHENYour team writes standup updates by hand every morning and half of them say "same as yesterday".
YOU GET
An n8n workflow skeleton, the Linear GraphQL query, and the Slack Block Kit payload
ON THIS PAGEVERIFIED 29 AUG 2026 - RESOURCE DROP11 MIN READ
20 automation ideas worth stealing: trigger, tool, and time saved
USE WHENYou know automation would help but you don't know which one to build first.
YOU GET
A 20-entry index with trigger → action for each
ON THIS PAGEVERIFIED 28 AUG 2026 - RESOURCE DROP7 MIN READ
Claude vs GPT vs Gemini: context, pricing, and what each is best for
USE WHENYou're about to commit a build to one model and want the specs that actually decide it.
YOU GET
8 comparison tables across models, image, video, voice, automation and code tools
ON THIS PAGEVERIFIED 28 AUG 2026 - RESOURCE DROP4 MIN READ
5 n8n automation workflows that save 10+ hours a week (with the JSON)
USE WHENYou've picked an automation to build and want the actual node chain, not another list of ideas.
YOU GET
5 n8n workflow skeletons in JSON, plus Zapier equivalents
ON THIS PAGEVERIFIED 28 AUG 2026 - RESOURCE DROP8 MIN READ
System design document template: 9 sections, with a worked example
USE WHENYou are about to start a build and haven't decided anything on purpose yet.
YOU GET
A 9-section design template plus a fully worked example
ON THIS PAGEVERIFIED 28 AUG 2026
