Loading…
Short pages for the searches founders type after a checkout that did not unlock the app.
Lovable Stripe webhook not working
Checkout says paid, but the Lovable app still shows the free plan. How to find the webhook bug and what to paste into Lovable.
Supabase RLS returns an empty array
Your query runs, the table has rows, and the client still gets []. This is usually row level security doing what you asked.
Supabase anon key can read other users' rows
If the anon key lists customer rows, RLS is off or a policy allows everyone. That is a data leak, not a configuration detail.
Bolt checkout succeeds but the user stays free
The Bolt app shows a thank-you page and the account is still locked. The upgrade lives in the webhook, not the success redirect.
Stripe webhook signature verification failed
Stripe keeps retrying and the dashboard says the signature doesn't match. The usual cause is the raw body or the wrong webhook secret.
A Lovable app shows another user's data
If you can change the id in the URL and see someone else's project, the page checks login and forgets ownership.
Stripe secret key shipped in the JavaScript
sk_live_ in a bundle is a live key. Rotate it. The browser should only ever see pk_ keys.
Supabase service_role key in the frontend
A service_role JWT bypasses row level security. It must never be in a bundle, even a 'server' file that actually ships to the browser.
Cursor app paywall never updates after payment
You shipped the paywall in Cursor, Stripe test mode looks fine, and the app still says upgrade. The missing piece is usually the webhook write.
Replit app never receives the Stripe webhook
The webhook endpoint is localhost, an old dev URL, or a Replit URL that slept. Stripe cannot reach it, so nobody gets upgraded.