What breaks, and the fix.
30 failures that hit AI-built apps after launch — each with the symptom, the cause, how to tell and the fix, and a prompt for your builder where it can do the work. Keelnest watches for every one.
Money
Payments against a learned baseline, webhook health, checkout evidence.
- Payments stop after a deployCheckout reaches the pay step and stalls, or orders never show as paid — and it started right after a publish.The fix
- Stripe disabled your webhook endpointPayments succeed in Stripe, but your app never marks them paid. The endpoint in Stripe's dashboard says Disabled.The fix
- “Webhook signature verification failed”Every Stripe delivery gets a 400 back, and your error log repeats the same line.The fix
- Real customers, test-mode keysCheckout works and says thank you. No money arrives, and Stripe's live dashboard shows nothing.The fix
- Stripe sends payment events to a preview, not your live appPayments go through, but paying customers do not get access, and your live app never sees a Stripe event.The fix
- Checkout succeeds; the order never happensCustomers pay. The app never sends the email, creates the account, or unlocks the thing they paid for.The fix
- Payments below what this hour usually bringsNo outage, nothing failing — just fewer payments than the same hour last week, for a few hours running.The fix
Publishes
Every deploy gets a verdict within five minutes.
- Sign-in breaks on your new domainYou moved to a custom domain. Existing sessions still work; new sign-ins fail after the magic link or the OAuth redirect, with “redirect_to is not allowed”.The fix
- Google or GitHub sign-in fails after a domain changeThe provider shows “redirect_uri_mismatch”, or sends people back to the wrong address.The fix
- It works in preview and breaks in productionThe preview deploy is fine. Production throws on the first request that needs a key.The fix
- Errors spike right after a publishWithin minutes of a deploy, error capture shows dozens of the same error on one page.The fix
- The build passed; the site returns 500Green build, red site. Every request fails, or a whole section does.The fix
- A publish broke a journeyAfter a release, a path your customers rely on — sign in, add to cart, reach checkout — stops at a step it used to pass.The fix
- Your certificate is about to expireThe TLS certificate has days left and has not been renewed. Soon browsers will warn visitors away from the site.The fix
- Your domain is about to expireThe domain's registration runs out in days. When it lapses, the site, its sign-in emails and its payment webhooks stop, and somebody else can buy the name.The fix
- No HSTS headerThe free health check reports Strict-Transport-Security missing.The fix
- No X-Content-Type-Options headerThe free health check flags the header as missing.The fix
- No frame protectionThe free health check reports neither X-Frame-Options nor a frame-ancestors policy.The fix
- The site is downA 5xx, or no answer at all, on two consecutive checks.The fix
- Slow answers, or a redirect to plain HTTPThe check reports Degraded: slow responses, or a redirect that lands on http://.The fix
Spend
AI and hosting usage against budgets, spike alerts.
- AI usage is several times its usual levelToken usage for an hour is four to six times what that hour normally sees. Nothing is failing.The fix
- An API key is in your public codeThe free health check — or a stranger — finds an OpenAI, Anthropic, OpenRouter, Replicate, Resend, Google Gemini or Stripe secret key, a Supabase service-role key, or an AWS access key, inside a script your browser downloads.The fix
- The hosting bill jumpedBandwidth, function invocations or compute far above last month, without more customers to show for it.The fix
- The AI provider is rate-limiting youFeatures that call the model fail now and then with 429. Users see spinners, or errors, at the busy times.The fix
Backend
Database and auth health, config drift, security advisors, whether auth email can be delivered.
- Sign-up emails do not arrivePeople sign up, the site says “check your inbox”, and nothing comes — for some of them or for all of them. Password resets and magic links go the same way.The fix
- Confirmation emails land in spam, or vanishThe mail is sent — your provider shows it delivered — and people find it in spam, or never at all.The fix
- Anyone can read your Supabase tablesThe app works, and a stranger with your site open can read your users, orders or messages straight from the database — without signing in.The fix
- Your Supabase project is paused or downThe site loads, but nobody can sign in and nothing that comes from the database appears: lists are empty, saves spin, and some pages go blank.The fix
- A connection's token expiredCoverage drops to Partial. The app is still watched for uptime, but its database, auth or payment observations stop.The fix
Code
What changed in each publish, and later, repairs.
Not on the list?
Run the free health check on your production address: it reads the page the way a browser does and names what it finds. Or watch it continuously — free for your first app.
May we use Google Analytics to see which pages help? No advertising cookies either way. Privacy