# ReplayWatch

> Free scan for Lovable, Bolt, Replit, and Cursor apps. Get a score out of 100 and see exactly what is exposed.

ReplayWatch checks the public side of an AI-built app: page load, security headers, secrets in HTML and JavaScript, Supabase or Firebase data readable without signing in, broken links and assets, SEO tags, and whether a signup page is reachable. The free scan does not log in or submit a form.

- Site: https://replaywatch.com
- Free scan: https://replaywatch.com/#scan
- Guides: https://replaywatch.com/guides

## Guides

- [Cursor Broke My App? How to Revert and Prevent It](https://replaywatch.com/guides/cursor-broke-my-app-how-to-revert): Cursor's agent broke working code? Roll back with Restore Checkpoint, Local History or git, and set up git so the next bad edit takes one command to undo.
- [Bolt.new Works in Preview, Broken on Netlify? 5 Fixes](https://replaywatch.com/guides/bolt-new-works-in-preview-broken-on-netlify): Bolt app fine in preview but blank or broken on Netlify? It's usually missing VITE_ env vars, the wrong publish folder, Node version or auth URLs.
- [Supabase Service Role Key Exposed in JS? Check and Rotate](https://replaywatch.com/guides/supabase-service-role-key-exposed): Found a Supabase key in your app's JS? The anon/publishable key is meant to be public; a service_role or secret key isn't. Check which, then rotate.
- ['new row violates row-level security policy': Why the AI Can't Fix It](https://replaywatch.com/guides/supabase-rls-policy-error): Supabase returns 'new row violates row-level security policy' or empty arrays in your Lovable, Bolt or Cursor app. Here's the actual fix: add the right RLS policy, and don't turn RLS off.
- [Did the AI Break Something? A Regression Checklist for AI-Built Apps](https://replaywatch.com/guides/regression-checklist-after-ai-edit): A practical checklist for non-developers to confirm a Lovable, Bolt, Cursor or Replit edit didn't break signup, login, data access or the live site, plus how to roll back safely.
- [Lovable Failed to Fetch / CORS Error After Deploy: Fixes](https://replaywatch.com/guides/lovable-failed-to-fetch-cors-error): Lovable app shows 'Failed to fetch' or a CORS error once live? Check Supabase env vars, edge function CORS headers, OPTIONS handling and redirect URLs.
- [Lovable or Bolt App Blank in Production? Fix Missing Env Vars](https://replaywatch.com/guides/blank-page-production-missing-env-vars): Your AI-built app works in preview but shows a blank page once deployed. Here's how to find the error and fix missing VITE_ environment variables on Vercel, Netlify or Lovable.
- [Replit Publish Failed? Fix Port, Database and Secrets Errors](https://replaywatch.com/guides/replit-publish-failed): Replit app builds fine but publishing fails or the live app breaks. Step-by-step fixes for 'port was never opened', paused databases, missing production secrets and the wrong deployment type.
- [Supabase 42501 "permission denied for table": Causes and Fixes (Oct 30, 2026 GRANT Change)](https://replaywatch.com/guides/supabase-42501-permission-denied): Getting Supabase error 42501 permission denied for table? Here's why it happens, including the Oct 30, 2026 explicit-GRANT change, plus SQL fixes for GRANTs and RLS policies.
- [Supabase Login Works Locally but Not on Your Live Site: How to Fix It](https://replaywatch.com/guides/supabase-login-works-locally-not-live): Login or signup works on localhost or in the Lovable preview but fails on Vercel or your custom domain. Step-by-step fixes for Site URL, redirect URLs, env vars, email and OAuth.