Paid kit · On sale

The Vibe Coder's Fix & Launch Kit

Debug faster, lock down Supabase, and ship your AI-built app without the 2 a.m. surprises. The free fix library answers one error at a time. This kit is the system around it.

$19
Buy the kit, $19

PDF (60 pages) + Markdown · single-user license · free 1.x updates · checkout by Gumroad

Read a free sample first ↓

Who it's for

For you if:

  • You build with Cursor, Claude Code, Codex, Lovable, Bolt, Replit or v0, and your AI tool keeps "fixing" the same bug in circles.
  • Your app works on your machine and breaks once it's deployed.
  • You use Supabase and aren't sure strangers can't read each other's data.
  • You're about to share the link and want a checklist to run first.

Probably not for you if:

  • You're on a team with a security engineer and an established deploy process. You already have most of this.

What's inside

  1. The Debug LoopA 5-step method for any bug: checkpoint, capture, isolate, fix small, verify. Plus how to break an AI fix loop.
  2. 24 master promptsDiagnose First, Fix-Loop Breaker, Works-Locally-Broken-After-Deploy, Secrets Sweep, Write My RLS, Context Handoff and more.
  3. 12 deep fix playbooksEnv vars after deploy, CORS, Supabase RLS, leaked keys, OAuth redirects, hydration, 404 on refresh, Stripe webhooks, AI API errors.
  4. Supabase security templatesPaste-ready RLS for six common data shapes, storage policies, a profile trigger, and SQL that tests your policies as two users.
  5. Launch checklistsA 55-point pre-launch checklist and deploy checklists for Vercel, Netlify, Cloudflare Pages, Railway, Render, Lovable, Bolt, Replit and v0.
  6. Incident runbook + templatesThe first 15 minutes when your live app is down, rollback steps per host, and bug-report and handoff templates.
All 24 prompts by name
  1. P1 Diagnose First
  2. P2 Fix-Loop Breaker
  3. P3 Explain This Error Like I'm New
  4. P4 Smallest Safe Fix
  5. P5 Add Targeted Logging
  6. P6 Reproduce in Isolation
  7. P7 Undo and Retry Cleanly
  8. P8 Dependency and Version Conflict
  9. P9 Works Locally, Broken After Deploy
  10. P10 Build Failed on the Host
  11. P11 Environment Variable Audit
  12. P12 Secrets Sweep
  13. P13 Write My RLS Policies
  14. P14 Audit My Existing RLS
  15. P15 Auth Flow Review
  16. P16 Payments and Webhook Review
  17. P17 Pre-Launch Security Review
  18. P18 Error Handling and Empty States
  19. P19 Speed Pass
  20. P20 Write a Test for This Bug
  21. P21 Review the Diff Before I Accept It
  22. P22 Safe Refactor
  23. P23 Context Handoff (New Chat)
  24. P24 Project Rules File
All 12 fix playbooks by name
  1. F1 Works locally, broken after deploy
  2. F2 Public env var is undefined in the browser
  3. F3 Blocked by CORS policy
  4. F4 Supabase: new row violates row-level security policy
  5. F5 Supabase query returns [] with no error
  6. F6 A secret key is in the browser bundle
  7. F7 Sign-in redirects fail
  8. F8 Hydration failed
  9. F9 Module not found, but only on the host
  10. F10 404 when refreshing any page except home
  11. F11 Stripe: no signatures found matching the expected signature
  12. F12 AI API calls fail: 401, 429, or timeouts

Free sample

Two real excerpts from the kit, word for word. Use them, even if you never buy it.

From Chapter 2: Prompt P1, Diagnose First

Every prompt in the kit asks for the cause before your AI tool touches code.

Sample promptPaste into Cursor, Claude Code, Codex, Lovable, Bolt, Replit or v0
I have a bug. Do NOT change any code yet.

Error (exact text):
[PASTE THE ERROR]

Where it appears: [browser console / terminal / build log / host logs / on the page]
How to trigger it: [EXACT STEPS]
What changed right before it started: [LAST CHANGE OR DEPLOY]
Stack: [e.g. Next.js + Supabase on Vercel]

Please:
1. Explain in 2-3 plain-English sentences what this error means.
2. List the 3 most likely root causes, ranked, with the evidence for each.
3. Name the exact files and lines you'd look at, and why.
4. Tell me one quick check I can run to confirm the top cause.
Wait for my reply before editing anything.

From Chapter 5: the first two sections of the 55-point pre-launch checklist

Items marked MUST are the ones that cause real damage if you skip them.

Secrets and keys

  • MUST No secret keys in frontend code, in public env vars (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_), or in the repo. Run Prompt P12.
  • MUST .env files are in .gitignore, and git ls-files | grep -i env shows only .env.example.
  • MUST Any key that was ever committed or shipped to the browser has been rotated.
  • Test-mode keys (Stripe sk_test_, development Supabase project) aren't used in production, and live keys aren't used in development.
  • Spend limits or usage alerts are set on every paid API (AI providers, email, SMS, maps).

Database and data access

  • MUST RLS is enabled on every table in public (audit query in Chapter 4).
  • MUST You've tested as user A, user B and signed-out (test blocks in Chapter 4).
  • MUST Users can't change their own role, plan, credits or "paid" flag.
  • Storage buckets are private unless the files are meant to be public, and have size and file-type limits.
  • The Supabase Security Advisor shows no critical issues.
  • Backups: you know how your database is backed up and how to restore it (check what your plan includes), and you've exported a copy before launch.
  • You have separate development and production databases, or at least you never test destructive changes on production.

The full checklist goes on to authentication, payments, abuse and cost protection, reliability, performance, SEO and legal, then launch day.

Get the free Pre-Launch Security Checklist (PDF) — the two sections above, plus the checks to run before every first deploy.

Questions

What format is it?

A 60-page PDF designed for reading on screen (dark theme, clickable contents), plus the same content as a Markdown file so you can copy prompts and SQL straight into your editor.

How do I get it?

Checkout is handled by Gumroad. After you pay, Gumroad gives you the download for the PDF and the Markdown file.

Do I need to be a developer?

No. It's written in plain English for people building with AI coding tools. The prompts do the heavy lifting; the checklists tell you what to verify.

Is the free fix library going away?

No. Every fix page stays free. The kit is the system around those fixes: the method, the security templates and the launch checklists.

Which tools does it cover?

Cursor, Claude Code, Codex, Lovable, Bolt, Replit and v0, with Supabase for data and auth, and Vercel, Netlify, Cloudflare Pages, Railway and Render for hosting.

Do I get updates?

Yes. Updates to version 1.x are free.

Can I use it for client work?

Yes. The single-user license covers your own commercial and client projects. Please don't resell or share the kit itself.

General technical guidance, not professional security advice. Not affiliated with any of the tools named.

Get the whole kit

The method, 24 prompts, 12 playbooks, Supabase templates, the 55-point checklist, deploy checklists, the runbook and templates. PDF + Markdown.

Buy the kit, $19

Need more than the kit?

Free checker for your repo, guardrails for your AI tool, or a reviewed second opinion.

Compare all →

  1. Free

    Repo checker

    vibefix-check finds leaked keys, tables without RLS and unsigned Stripe webhooks in your own code.

    • 14 checks, runs locally
    • Every finding links to a fix
    • Works in CI (fails a PR on high risk)
    Get the checker

  2. $19

    Fix & Launch Kit

    The system behind the fix pages: a debug method, prompts, Supabase templates and checklists.

    • 60-page PDF + Markdown
    • 24 prompts, 12 playbooks
    • 55-point pre-launch checklist
    Get the kitWhat's inside →

  3. $49

    Lockdown Pack

    Guardrails in your repo so your AI tool never “fixes” an error by turning security off.

    • AGENTS.md + Cursor rules
    • 5 agent skills (review, RLS writer, secrets sweep…)
    • RLS audit + two-user test SQL, CI gate
    Get the Lockdown Pack

  4. $149

    Launch Review

    A security review of your app, approved by a human before you get it.

    • Report in 48 hours, ranked by severity
    • Paste-ready fixes + one re-check
    • Read-only · max 10 per week
    Book a review

Checkout by Gumroad. 14-day refunds on all paid tiers (Launch Review: before delivery, or if the report has nothing actionable). General technical guidance, not a guarantee your app is secure.