AIArticle A weekend SaaS's failure list maps exactly onto the seam AI coding agents can't see: your deployment.
Priya Nair There's a new genre of dev-blog post: build a full SaaS in a weekend with an AI editor, then catalog the wreckage. The latest entry — a solo developer who shipped an AI workspace called NexusOS almost entirely by directing Cursor — is worth reading not because things broke, but because of where they broke. Not one failure on the list is a code bug. Every single one lives at the seam between the repository and the running system.
That's the real finding, and it generalizes far beyond one weekend project.
The failure list, sorted #
Look at what actually went wrong, per the author's account. The Next.js build passed locally and died on Vercel because API routes get evaluated at build time and the Prisma client demanded a DATABASE_URL
that only existed in the local Docker setup. Then the build succeeded and every request 500'd anyway, because migrations had never run against the production database — fixed by chaining prisma generate && prisma migrate deploy && next build
, with the extra gotcha that Prisma skips deployment quietly if migration_lock.toml
is missing. The pgvector extension had to be enabled inside a migration rather than by hand, or the next fresh environment breaks. Groq turned out to have no embeddings endpoint, so the RAG pipeline needed a second provider. Stripe subscription state had to move from "trust the redirect" to signature-verified webhooks.
Environment topology. Migration ordering. Extension provisioning. Provider capability gaps. Trust boundaries. This is an ops runbook, not a bug tracker.
And that's exactly what you'd predict. Cursor's models trained on millions of repositories, and repositories contain application code. What they don't contain is your deployment: which environment variables exist where, whether migrations have run against this database, whether the build machine can reach Postgres. That state isn't in the context window because it isn't in any file. The agent writes code that's correct relative to an environment it can't see.
The scariest bug made no noise #
One failure deserves its own paragraph. The app's research feature returned confident, well-formatted reports with citations reading "Sources: [n/a, AI knowledge only]" — because the web search API key was never configured, and the LLM filled the gap by generating from memory. Nothing crashed. Nothing logged an error. The output looked exactly like the output was supposed to look.
This is the failure class that should worry you, because it inverts the economics of debugging. A missing table screams at you with a stack trace within minutes of deploy. A research tool that silently degrades into a hallucination engine ships, gets used, and erodes trust one fabricated citation at a time. AI-assisted development is shifting the failure distribution from loud-and-cheap (syntax errors, type errors, missing imports) toward quiet-and-expensive (plausible output that's semantically wrong). Veracode's 2025 GenAI Code Security Report found that 45% of AI-generated code across 100+ models introduced security vulnerabilities — and vulnerabilities are just the subcategory of silent wrongness that scanners can catch. Fabricated citations don't show up in a SAST report.
The broken glue is someone's business model #
Here's the industry-level tell: take that failure list and read it as a product roadmap. Database provisioning, automatic migrations, per-environment secrets, managed integrations — that's precisely the surface Replit, Lovable, and Vercel's own v0-plus-marketplace stack are selling. The prompt-to-production platforms exist because the seam between generated code and running system is where weekend projects go to die. They're not competing with Cursor on code generation; they're competing on owning the glue.
The trade-off is real, though. Hand the seam to a platform and you inherit its blast radius — Replit's agent famously deleted a production database during an explicit code freeze in July 2025. Keep the seam yourself, and you're signing up for exactly the weekend this author had. There's no third option where nobody owns deployment state.
What this means for how you build #
If you're using Cursor or any coding agent for a full-stack project, the practical playbook falls out of the failure list directly: Deploy on hour one, not day two. Every environment-seam bug in this story was discoverable with a single early push to the real target. "Works locally" is a statement about your Docker setup, nothing more.Make configuration fail loudly. Validate required env vars at boot and crash if they're absent. The hallucinated-citations bug existed only because a missing key degraded silently instead of fatally.Put schema state in the migration path, all of it. Extensions, seed constraints, vector indexes — anything done by hand in one environment is a landmine in the next.Test the negative case on trust boundaries. An unsigned Stripe payload should get a 400. If you haven't sent one, you don't know.Verify outputs, not vibes. For any AI feature, build the check that distinguishes "grounded in retrieved data" from "generated from thin air" before you build the pretty formatting.
One caveat on the source itself: this is a single self-reported account (with a promotional flourish at the end), so treat the narrative as illustrative rather than evidentiary. But every technical claim in it checks out independently — Groq's API genuinely lacks embeddings, Prisma's migration-detection failure modes are documented GitHub issues, and Next.js build-time evaluation has burned thousands of people before Cursor existed.
The honest conclusion isn't "AI coding is overhyped." The app shipped, works, and took a weekend — that was a month of work three years ago. The conclusion is that codegen has collapsed the cost of the part of software that was already cheapest, and left the expensive part — provisioning, configuration, verification, trust — almost untouched. The developers who thrive with these tools won't be the best prompters. They'll be the ones who can look at a green build and know all the ways it's still lying to them.
Sources & further reading #
I shipped a full-stack AI SaaS in a weekend with Cursor. Here is everything that broke.— dev.to -
[2025 GenAI Code Security Report](https://www.veracode.com/resources/analyst-reports/2025-genai-code-security-report/)— veracode.com -
[Error: Could not determine the connector from the migrations directory (missing migration_lock.toml)](https://github.com/prisma/prisma/issues/25952)— github.com -
[API Reference - GroqDocs](https://console.groq.com/docs/api-reference)— console.groq.com
[Priya Nair](https://sourcefeed.dev/u/priya_nair)· AI & Developer Experience Writer
Priya covers AI frameworks, developer productivity tooling, and the startup ecosystem across South and Southeast Asia, bringing a researcher's rigour and a practitioner's empathy to every story. She is deeply sceptical of benchmarks and asks hard questions so her readers don't have to.
Discussion 0 #
No comments yet
Be the first to weigh in.