Skip to content
ReplayWatch

Guides

Did the AI break something? A checklist to run after every edit

Niall Hackett ·

AI coding tools often change more files than your prompt suggested. You ask for a navbar fix, and an auth file changes too. This checklist takes about ten minutes and catches most silent breaks before your users do.

Before you prompt

  1. Turn on GitHub sync (Lovable, Bolt) or note the current checkpoint (Replit). You need a known-good version to go back to.
  2. Write down your critical flows. Usually 3–5: sign up, log in, the one core action, payment, log out.
  3. Use a staging database for risky changes. A second Supabase project (the free tier is fine) keeps experiments away from real user data.

Right after the AI edit

  1. See what actually changed. On GitHub, open the commit or run git diff --stat. Be wary if auth, middleware, the Supabase client, migrations or env config changed when you didn't ask for that.
  2. Read migrations before applying them. Look for drop, alter ... drop column, or disable row level security.
  3. Check the build passes before you publish.

After you publish

Do this in an incognito window with DevTools open:

  1. Load the home page: is the console clean, and is there nothing red in Network?
  2. Sign up with a brand-new email. Does the confirmation email arrive, and does its link point at your live domain?
  3. Log out, then log back in.
  4. Do the core action once from start to finish.
  5. As user A, try to open a URL or record that belongs to user B. You should be blocked.
  6. Check on a phone (Safari, if you can).

If something broke

  1. Roll back first to the last good version or checkpoint and republish. Get users unblocked.
  2. Then debug on the broken version: copy the first console error and ask the AI to explain the cause before it changes code.
  3. Don't hit "try to fix" again and again. Each failed attempt adds noise. Start a fresh chat or fork with the error message and the diff.

What a click-through misses

Some problems don't show up when you click around as yourself:

  • API keys that ended up in your frontend JS
  • Supabase or Firebase tables that anyone can read without logging in
  • Missing security headers
  • Broken images, scripts or links on pages you didn't visit
  • Missing or duplicated SEO tags

Run a free ReplayWatch scan. Paste your live URL and ReplayWatch checks it for page load, security headers, secrets exposed in your HTML/JS, Supabase/Firebase data that is readable without login, broken links and assets, SEO tags, and whether your signup page is reachable. It does not log in or run your signup flow. → https://replaywatch.com/#scan