Fixes for Bolt apps

Supabase query returns an empty array (no error)
data: [] — select works in the SQL editor but returns nothing in the app
LovableBoltv0Database / Supabase RLS

new row violates row-level security policy for table
new row violates row-level security policy for table "profiles" (code 42501)
LovableBoltCursorDatabase / Supabase RLS

Supabase service_role key exposed in frontend code
service_role key found in the JS bundle / NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY
LovableBoltv0CursorEnv vars & leaked keys

OpenAI / Stripe secret key leaked in the browser
sk-... or sk_live_... visible in DevTools network tab or page source
LovableBoltv0ReplitCursorEnv vars & leaked keys

Environment variable is undefined in production
process.env.X is undefined / import.meta.env.VITE_X is undefined after deploy
Cursorv0BoltEnv vars & leaked keys

Magic link / OAuth login redirects to localhost:3000
After clicking the email link or Google login, the browser opens http://localhost:3000
LovableBoltv0CursorAuth

Error 400: redirect_uri_mismatch (Google sign-in)
Error 400: redirect_uri_mismatch — The redirect URI in the request does not match the ones authorized
CursorReplitBoltAuth

User is logged out after page refresh
After reload, user is null and protected pages redirect to /login
LovableBoltv0Auth

Stripe webhook: No signatures found matching the expected signature
StripeSignatureVerificationError: No signatures found matching the expected signature for payload
CursorBoltReplitv0Payments

Payment succeeds but the user isn't upgraded
Stripe shows the payment as succeeded but the app still shows the free plan
LovableBoltCursorPayments

No such price / No such customer (test vs live mode mix-up)
StripeInvalidRequestError: No such price: 'price_...'
CursorBoltv0LovablePayments

Vercel build fails: Type error / ESLint errors (works locally)
Failed to compile. Type error: ... / Error: Command "npm run build" exited with 1
Cursorv0BoltDeploys

404 NOT_FOUND when refreshing a page (React/Vite SPA)
404: NOT_FOUND on /dashboard after refresh or when opening a direct link
LovableBoltDeploys

CORS error: blocked by CORS policy: No 'Access-Control-Allow-Origin' header
Access to fetch at 'https://api...' from origin 'https://...' has been blocked by CORS policy
CursorReplitBoltv0Deploys

Supabase Edge Function fails with CORS or 'Failed to send a request'
FunctionsFetchError: Failed to send a request to the Edge Function / CORS preflight failed
LovableBoltDatabase / Supabase RLS

App is slow: dozens of database calls per page (N+1 queries)
Page takes 3–10s; network tab shows many identical requests
LovableBoltCursorv0Performance

Too many re-renders / useEffect infinite loop
Error: Too many re-renders. React limits the number of renders / Maximum update depth exceeded
LovableBoltv0CursorPerformance

Supabase Storage upload fails: new row violates row-level security policy (403)
StorageApiError: new row violates row-level security policy (403 Unauthorized)
LovableBoltv0Database / Supabase RLS

OpenAI 429 'You exceeded your current quota' or a surprise AI bill
429: You exceeded your current quota, please check your plan and billing details
CursorReplitBoltLovableEnv vars & leaked keys

.env file committed to GitHub
GitHub secret scanning alert / .env visible in a public repo
CursorReplitBoltEnv vars & leaked keys

Postgres error: relation "public.xyz" does not exist
ERROR: 42P01: relation "public.profiles" does not exist / PostgREST could not find the table
LovableBoltCursorv0Database / Supabase RLS

Supabase "permission denied for table" (42501) on a new table
{"code":"42501","message":"permission denied for table your_table","hint":"Grant the required privileges to th
LovableBoltCursorv0ReplitDatabase / Supabase RLS