# Snapforge Lab

> Snapforge Lab is an independent studio that fixes the security and launch issues of AI-built apps (Replit, Lovable, Bolt, Cursor, Supabase). The path is simple: (1) a free read-only security audit of the live app in 24 hours (exposed Supabase tables with Row Level Security off, secrets in the JS bundle, open CORS with credentials, unverified Stripe webhooks, auth redirects to preview domains); (2) a 15-minute call to agree on what to fix; (3) the Launch Fix Sprint, the main offer: $990 flat, done for you in 5 business days, paid only after the fixes are verified working. Safe to Launch ($149, $49 founding price for the first 3 clients) is the smaller option for one quick fix in 48 hours. It also builds custom business apps on Replit on a fixed-price quote, for clients worldwide.

## Main path
- [Free security audit](https://snapforgelab.com/free-audit): step 1, free. Read-only security check of a live Replit, Lovable or Bolt app, private audit page with exact fix steps within 24 hours. Lovable & Bolt version: https://snapforgelab.com/lovable-bolt-audit
- 15-minute call: step 2, free. Agree on the list of issues to fix, fixed scope and fixed price (book by email: hello@snapforgelab.com).
- [Launch Fix Sprint](https://snapforgelab.com/launch-fix-sprint/): step 3, the main offer. $990 flat, done for you in 5 business days: the top issues from the free audit fixed (security, uptime, CORS and secrets, performance, SEO basics), retested, with a written report. Paid only after the fixes are verified working, nothing upfront. Guarantee: if a fixed issue comes back within 14 days, I fix it free.

## Smaller options
- [Safe to Launch](https://snapforgelab.com/safe-to-launch/): the smaller fallback when only one quick fix is needed. $149 flat (founding price $49 for the first 3 clients, in exchange for a testimonial). An AI-built app (Replit, Lovable, Bolt or Cursor) checked the way an attacker would and fixed in 48 hours: exposed keys and secrets, database access rules, login and accounts, payments and webhooks, deploy and environment settings, backups. Delivers the fixes pushed and tested, a 1-page report and a 5-minute video walkthrough. Guarantee: if a fixed issue comes back within 14 days, I fix it free. If I find nothing worth fixing, you pay nothing.
- [Replit Deploy Fix](https://snapforgelab.com/deploy-fix/): $49 fixed price to fix one Replit deployment or configuration blocker (failing build or publish, secrets, database connection, custom domain) in 48 hours, full refund if not fixed.
- [Ship-Ready Prompt Pack](https://snapforgelab.com/prompt-pack/): $19 one-time PDF (7 pages, October 2026 edition) to fix it yourself: 16 copy-paste prompts and a 15-point checklist to fix SEO, Supabase RLS, secrets, auth redirects, Stripe webhooks and deploys on apps built with Replit Agent, Lovable and Bolt. Paid with PayPal, emailed within a few hours, full refund within 14 days if it doesn't help.
- [Replit app security](https://snapforgelab.com/replit-app-to-production/): security, auth, data and deployment checks for apps built with Replit Agent: free audit in 24 hours, then the Launch Fix Sprint ($990 flat, 5 business days, paid after the fixes are verified); Safe to Launch ($149) for one quick fix.

## After launch and other services
- [Care](https://snapforgelab.com/#pricing) (after a fix, $249/month, cancel anytime): continuous security monitoring of a live app, with a security re-check after every release plus a monthly full pass, an alert within 1 business day if a new issue appears, fixes for what the re-check finds, bug fixes and security updates, hosting and uptime monitoring, small monthly improvements, priority support within 1 business day.
- [Starter Build](https://snapforgelab.com/#contact): custom business app built from scratch, fixed-price quote within 48 hours on request.
- [Hire a Replit developer](https://snapforgelab.com/hire-replit-developer/)

## Free tools
- [Replit Readiness Score](https://snapforgelab.com/tools/replit-readiness-score/): 2-minute self-assessment that scores whether a Replit app is ready for real users.

## Guides
- [Is Replit production-ready? An honest answer for business apps](https://snapforgelab.com/guides/is-replit-production-ready/): Can you run a real business app on Replit? What the platform handles well, where AI-built apps fall short, and a 10-point test before you launch.
- [Replit Agent security checklist: 15 checks before you launch](https://snapforgelab.com/guides/replit-agent-security-checklist/): 15 security checks for Replit Agent apps before launch: secrets, authorization, validation, data, dependencies and costs, with how to test and fix each.
- [How to deploy a Replit app to production, step by step](https://snapforgelab.com/guides/deploy-replit-app-to-production/): A launch runbook for Replit apps: pick the deployment type, set production secrets, prepare the database, connect a custom domain and add monitoring.
- [Supabase's October 30 grants change: what breaks, and the prompt that fixes it](https://snapforgelab.com/guides/supabase-october-30-grants-change/): From Oct 30, 2026, new Supabase tables in public need an explicit GRANT or the Data API returns 42501. The fix, a Lovable/Bolt prompt and a self-check.
- [AI-built CRM security checklist: 12 checks before you sell it (or after you bought one)](https://snapforgelab.com/guides/ai-built-crm-security-checklist/): Built a CRM or ERP with Claude Code, Lovable or Replit for a client? 12 read-only security checks: mailbox OAuth, API keys, RLS, admin routes, .env, backups.
- [Replit Autoscale vs Reserved VM vs Static vs Scheduled: which deployment should you choose?](https://snapforgelab.com/guides/replit-deployment-types/): Autoscale, Reserved VM, Static or Scheduled? How each Replit deployment type works, cold starts, background jobs and costs, plus a 30-second decision tree.
- [Replit Agent keeps breaking your app? How to stop the fix loop](https://snapforgelab.com/guides/replit-agent-keeps-breaking-app/): Why Replit Agent fixes one bug and breaks another, how to roll back safely with checkpoints, and a prompting workflow that stops the loop.
- [Replit development vs production database: how it works, and how not to lose data](https://snapforgelab.com/guides/replit-production-database/): How Replit's dev and production databases work, what Agent can't touch, how schema changes reach production, and 5 habits to never lose customer data.
- [Replit Agent costs: 12 ways to cut your bill without slowing down](https://snapforgelab.com/guides/replit-agent-costs/): Why Replit Agent bills climb under effort-based pricing, where the money goes (Agent, deployments, databases) and 12 habits to keep spend predictable.
- [Replit Secrets: how to store API keys safely](https://snapforgelab.com/guides/replit-secrets-api-keys/): How Replit Secrets work, how to read them in Node.js and Python, how to keep keys out of the browser and Agent chats, and what to do after a leak.
- [Replit vs Lovable vs Bolt for business apps: which should you choose?](https://snapforgelab.com/guides/replit-vs-lovable-vs-bolt/): An independent comparison of Replit, Lovable and Bolt for real business apps: backend, database, deployment, background jobs and code ownership.
- [Replit deployment failed: fix the port and 0.0.0.0 errors](https://snapforgelab.com/guides/replit-deployment-failed-port/): Publishing fails at the promote step, or the live app says it failed to respond? Fix the host, PORT and .replit port settings that break Replit deployments.
- [Replit app works in preview but not after deploy](https://snapforgelab.com/guides/replit-works-in-preview-not-deployed/): Your Replit Agent app works in the preview but breaks once published: missing data, failed API calls, login or payments. The checklist that finds the cause.
- [Replit secrets not working in deployment? How to fix it](https://snapforgelab.com/guides/replit-secrets-not-working-deployment/): Your API key works in the workspace but is undefined in the published Replit app. Check deployment secrets, sync, republishing and frontend build variables.
- [Replit custom domain or SSL not working? Fix the DNS](https://snapforgelab.com/guides/replit-custom-domain-not-working/): Custom domain stuck on Verifying, SSL errors, or "deployment could not be reached" on Replit? Fix A and TXT records, Cloudflare proxy, AAAA and CAA issues.
- [Replit app shows 404 on page refresh? Fix SPA routing](https://snapforgelab.com/guides/replit-404-on-page-refresh/): Your React app on Replit works from the homepage, but deep links and refresh return 404. Add the right fallback route or rewrite without breaking APIs.
- [Replit deployment build failed: how to read the logs and fix it](https://snapforgelab.com/guides/replit-deployment-build-failed/): Replit publish fails during the build, gets stuck, or says the image exceeds 8 GiB? Read the build log, find the first error and fix the usual causes.
- [Replit Autoscale cold starts: why the first load is slow](https://snapforgelab.com/guides/replit-autoscale-cold-start/): Your Replit app takes seconds to load after a quiet period? That is an Autoscale cold start. Shorten startup, or choose Reserved VM when it really matters.
- [Replit cron jobs not running in production? Here is why](https://snapforgelab.com/guides/replit-cron-jobs-not-running/): Your setInterval or node-cron job works in the preview but not on Replit Autoscale. Move it to a Scheduled deployment or a protected endpoint on a schedule.
- [Replit changes not showing after deploy? 5 reasons and fixes](https://snapforgelab.com/guides/replit-changes-not-showing-after-deploy/): You published, but the live Replit app still shows the old version. Republish, fix index.html caching and service workers, and check the data source.
- [Lovable app not working after publish? 7 fixes, by symptom](https://snapforgelab.com/guides/lovable-app-not-working-after-publish/): Lovable app broken after you publish? 7 fixes by symptom: changes not live, failed publish, blank page, login, missing data, custom domain, outside hosting.
- [Replit database connection errors in production: how to fix them](https://snapforgelab.com/guides/replit-database-connection-error-production/): DATABASE_URL not set, endpoint disabled, SSL required or pool exhausted in your published Replit app? Diagnose the error and fix the Postgres connection.
- [Uploaded files disappear after you redeploy on Replit? Fix it](https://snapforgelab.com/guides/replit-uploaded-files-disappear/): User uploads, avatars or generated PDFs vanish after a Replit republish or restart. The published filesystem is not persistent: move files to App Storage.
- [How to run database migrations on Replit production safely](https://snapforgelab.com/guides/replit-database-migration-production/): Schema changes work in dev but break the published Replit app, or publishing warns about data loss. Apply migrations to production without dropping data.
- [The best ways to fix a broken Replit or Lovable app in 2026](https://snapforgelab.com/guides/best-ways-to-fix-replit-lovable-app/): Every realistic way to fix an AI-built Replit or Lovable app in 2026: DIY prompting, freelancers and fixed-price specialists, with published prices.
- [Stripe webhook not working on Replit? How to fix it](https://snapforgelab.com/guides/stripe-webhook-not-working-replit/): Payments succeed but your Replit app never updates? Fix the webhook URL, signing secret, raw body, test vs live mode and middleware that block Stripe.
- [Google sign-in fails on Replit with redirect_uri_mismatch: fix it](https://snapforgelab.com/guides/replit-google-oauth-redirect-uri-mismatch/): Google login works in the preview but fails on your published Replit app with Error 400 redirect_uri_mismatch. Register the right URLs and fix the callback.
- [Login not working after deploy on Replit? Fix sessions and cookies](https://snapforgelab.com/guides/replit-login-not-working-after-deploy/): Users log in on your Replit app, then get logged out on the next click or loop back to login. Fix trust proxy, secure cookies, session secret and store.
- [CORS error on your Replit deployment? How to fix it](https://snapforgelab.com/guides/replit-cors-error/): Blocked by CORS policy after publishing on Replit? Use relative API URLs, allow only your real origins, handle credentials, and spot crashes posing as CORS.
- [Replit 502 Bad Gateway or 500 error after publishing: how to fix it](https://snapforgelab.com/guides/replit-502-bad-gateway/): Your published Replit app returns 502 Bad Gateway, a 500 error or Application failed to respond. Find the crash in the logs, fix it, or roll back fast.
- [Vite environment variables undefined on Replit? Here is why](https://snapforgelab.com/guides/replit-vite-env-variables-undefined/): import.meta.env values are undefined in your Replit React app, or process is not defined in the browser. Fix the VITE_ prefix and build-time values safely.
- [Replit app not indexed by Google? How to fix it](https://snapforgelab.com/guides/replit-app-not-indexed-google/): Google ignores your Replit app, robots.txt or sitemap.xml returns HTML, or every page has the same title. Fix the technical SEO basics of a Replit Agent app.
- [How to roll back Replit Agent changes (and what happens to your data)](https://snapforgelab.com/guides/replit-agent-rollback-checkpoint/): Agent broke your app? How Replit checkpoints and rollbacks work, why the database is not restored by default, and how to update the live app afterwards.
- [Replit deployment costs too high? How to find and cut them](https://snapforgelab.com/guides/replit-deployment-costs-too-high/): Your Replit hosting bill is higher than expected. Find what drives it, then fix timers, keep-alive pingers, machine size, max machines and heavy files.

## About
- [Simo](https://snapforgelab.com/about/): founder of Snapforge Lab, ranked in the top 1% of Replit Agent users. Writes every guide on this site.

## Contact
- Email: hello@snapforgelab.com
- Website: https://snapforgelab.com/