SYS://FIELD-REPORTS
Field Reports
Teardowns of apps built with Lovable, Bolt, v0, Cursor, and Claude Code — what shipped broken, what's a false alarm, and the exact two-hour fix. The audit, run in public.
The Monitor Was Green Through the Whole Outage
A SvelteKit app had a health endpoint and an uptime monitor — the checkbox was ticked. But the endpoint returned 200 no matter what, and the monitor ran inside the same server it was watching. Both would report calm through a real outage. A green dashboard nobody can trust is worse than no dashboard.
Read the report ▸You Charged the Card Once. Then What?
A subscription app charged the first month perfectly and handled nothing after it — no failed-renewal branch, no way to cancel without emailing support, no alert when a chargeback landed. The demo takes money. The lifecycle is where the money leaks back out.
Read the report ▸Anyone Could POST a Fake Payment to Your Webhook
A v0-built course platform granted access when Stripe said a payment succeeded. It never checked that the message was actually from Stripe — and it returned 200 even when the grant failed, so the dashboard stayed green while buyers got nothing.
Read the report ▸RLS Was On. The Server Just Walked Around It.
A Next.js + Supabase app had Row Level Security enabled on every table — the check everyone tells you to run passed clean. Then one server route used the service_role key and filtered by an id from the URL, and the whole wall may as well not exist.
Read the report ▸Four Headers, Five Minutes: The Least Glamorous Finding on the Audit
The Astro app shipped with zero security headers — no CSP, no HSTS, no clickjacking protection. Nothing catastrophic. Just the fastest, most-skipped win on the whole punch list: a public/_headers block you paste once.
Read the report ▸Dev and Prod Share One Database. There Is No Dev.
A teardown of a Remix + Supabase app with exactly one environment — where a careless migration in 'dev' rewrites live users' data, because dev and prod are the same project. The worst finding here isn't a critical. That's the honest, interesting part.
Read the report ▸The Backup You Never Restored Is a Guess
A teardown of a polished SvelteKit app on self-hosted Postgres with no automated backups, no restore test, and no way to roll back a bad deploy — and why 'I'll deal with it if something breaks' is the one plan that cannot work.
Read the report ▸The Sentry That Never Fired
An AI-built app had Sentry installed, so error tracking read as handled. It had never sent a single event. A green checkmark that buys confidence it hasn't earned is worse than a red one.
Read the report ▸One Thrown Error, and the Whole App Goes White
A Lovable-built app with no error boundaries anywhere — one render error on a null field white-screens the entire thing for every user, and there's no tracking to tell you it's happening.
Read the report ▸You Wrote req.body Straight to the Database
A Remix + Prisma app that looked shippable took whatever the browser sent and wrote it to the database — including the fields you thought only the server controlled. The worst part isn't the bug. It's the excuse everyone reaches for to dismiss it.
Read the report ▸Your .env Is in Your Git History — Deleting It Didn't Help
A Cursor-built Express API committed its .env, then deleted it a few commits later and called it fixed. The secret is still in the history — and rotating, not deleting, is the only thing that un-leaks it.
Read the report ▸Change the ID in the URL, Read Anyone's Data
A finished-looking Next.js app that logged you in, then handed you everyone else's records the moment you changed one number in the URL — and why 'you have to be logged in' was never the access control the owner thought it was.
Read the report ▸One Script Ran Your AI Endpoint All Night
A teardown of a polished v0-built OpenAI proxy where the finding that runs up a four-figure bill overnight isn't tagged CRITICAL — and the scary-sounding threat everyone fears isn't the expensive one.
Read the report ▸Your Firebase Database Was in Test Mode
A Firebase app that looked done was shipping with its database wide open to the internet — and the thing most reviewers scream about was the one thing that was working exactly as designed.
Read the report ▸The service_role Key Was in the Browser Bundle
A teardown of a finished-looking AI-built app that was one URL away from leaking every user's data — and why the thing most reviewers flag isn't the thing that would've breached it.
Read the report ▸