{"slug": "your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6", "title": "Your AI-built app works locally but breaks when you deploy it? Check these 6 things", "summary": "A deployment platform team has catalogued the six most common reasons AI-built apps fail on first deploy, including hardcoded localhost API URLs, build-time-only environment variables, apps that don't bind to 0.0.0.0 and $PORT, missing production databases and migrations, misconfigured CORS, and secrets exposed in frontend code. The team notes that a missing Row Level Security pattern exposed user data in more than 170 AI-built apps in 2025 (CVE-2025-48757), and advises reading build logs from the top since the first error is usually the real one.", "body_md": "You built an app with Cursor, Claude Code, Lovable or Bolt. On your laptop it's perfect. You deploy it, and you get a blank page, a `502`, or a login button that spins forever.\n\nWe run a small deployment platform, so we watch a lot of first deploys. Most of the failures we see happen before the app even starts, and the causes repeat. None of them mean the AI wrote bad code. They're the gap between \"runs on my laptop\" and \"runs on a server\", and AI tools rarely close that gap for you.\n\nHere are the six we see most, with the fix for each.\n\n`localhost`\nWhile you built the app, the API ran on your machine, so the AI wired the frontend to it:\n\n``` js\nconst res = await fetch(\"http://localhost:3000/api/todos\");\n```\n\nIn production, `localhost` means *the visitor's own computer*. Every request fails, and the browser console fills with `ERR_CONNECTION_REFUSED`.\n\n**Fix:** read the API address from configuration and set it per environment.\n\n``` js\nconst API_URL = import.meta.env.VITE_API_URL; // e.g. https://api.example.com\nconst res = await fetch(`${API_URL}/api/todos`);\n```\n\n`VITE_…`, `NEXT_PUBLIC_…` and `REACT_APP_…` variables aren't read at runtime. They're copied into your JavaScript at build time. If you add or change one on the server after the build, nothing happens.\n\n**Fix:** set them *before* the build runs on your hosting platform, then rebuild and redeploy.\n\nThis works on your laptop:\n\n```\napp.listen(5000);\n```\n\nOn a hosting platform, your app has to listen on all interfaces and on the port the platform gives it, usually in the `PORT` variable. Otherwise the platform's health check can't reach it, and the deploy fails or times out.\n\n**Fix:**\n\n``` js\nconst port = process.env.PORT || 3000;\napp.listen(port, \"0.0.0.0\");\n# Python / FastAPI\nuvicorn main:app --host 0.0.0.0 --port $PORT\n```\n\nLocally you had a SQLite file or a Docker Postgres with your test data. In production there's an empty database, or none at all, and your tables don't exist yet.\n\n**Fix:** create a production database, set `DATABASE_URL` to it, and run your migrations against it, either as part of the deploy or once by hand:\n\n```\nDATABASE_URL=\"postgres://…\" npx prisma migrate deploy\n# or: alembic upgrade head\n```\n\nFrontend on `app.example.com`, API on `api.example.com`: the browser refuses the API's responses unless the API says that origin is allowed. The error looks like a network failure, which makes it confusing.\n\n**Fix:** allow your frontend's production domain in the API's CORS settings. If you use cookies, list the exact domain instead of `*`:\n\n```\napp.use(cors({ origin: \"https://app.example.com\", credentials: true }));\n```\n\nAnything in frontend code is public: anyone can open the browser's dev tools and read it. To \"make it work\", AI tools sometimes put a service key or a third-party API key straight into the frontend.\n\n**Fix:** keep secrets on the server and call third-party APIs from your backend. If you use Supabase, only the *anon* key belongs in the frontend, and Row Level Security must be on for every table. In 2025, a missing-RLS pattern exposed user data in more than 170 AI-built apps ([CVE-2025-48757](https://www.superblocks.com/blog/lovable-vulnerabilities)).\n\nBefore your first deploy:\n\n`0.0.0.0` and `$PORT`\n`DATABASE_URL` set and migrations run\nIf your deploy still fails, read the build log from the top, not the bottom. The first error is usually the real one; everything after it is fallout.\n\n**What broke your first deploy?** Tell us in the comments. We'll add the common ones to this list.\n\n*We build [Infrly](https://getinfrly.com/?utm_source=devto&utm_medium=article&utm_campaign=six_things), which deploys GitHub repos as web services, static sites, cron jobs, PostgreSQL and Key Value, and is free during its public beta. This list comes from watching first deploys fail. This article was written with AI assistance and checked by us.*", "url": "https://wpnews.pro/news/your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6", "canonical_source": "https://dev.to/infrly/your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6-things-37cb", "published_at": "2026-10-06 10:35:11+00:00", "updated_at": "2026-10-06 10:48:04.329336+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-products"], "entities": ["Infrly", "Cursor", "Claude Code", "Lovable", "Bolt", "Supabase", "CVE-2025-48757"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6", "markdown": "https://wpnews.pro/news/your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6.md", "text": "https://wpnews.pro/news/your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6.txt", "jsonld": "https://wpnews.pro/news/your-ai-built-app-works-locally-but-breaks-when-you-deploy-it-check-these-6.jsonld"}}