Sign-in and auth emails that don't work in production
Most AI-built apps use the database provider's built-in sign-in, usually Supabase Auth. It works on day one with the provider's default email sender, which is rate-limited and meant for testing, and with redirect settings that still point at the preview address. Real users then hit emails that don't arrive and links that open the wrong site.
- Report, video and top 3 fixes in 48 hours
- Fewer than 3 real problems fixed? Full refund
- Collaborator access only, never your passwords
What it is, and why it matters
Most AI-built apps use the database provider's built-in sign-in, usually Supabase Auth. It works on day one with the provider's default email sender, which is rate-limited and meant for testing, and with redirect settings that still point at the preview address. Real users then hit emails that don't arrive and links that open the wrong site.
- New users never get the confirmation email, so they never become users.
- Magic links and password resets open the preview site, or an error page.
- Without email confirmation, anyone can sign up with someone else's address.
How I fix it
- A real email sender on your own domain (for example Resend, Postmark or Brevo) with SPF, DKIM and DMARC.
- Redirect URLs and email templates pointing at your live domain, in your app's voice.
- Email confirmation on, sensible password rules, and a rate limit on sign-up and reset requests.
A Launch Check includes this fix if it's one of your three biggest problems. Data anyone can read usually comes first.
What you get in 48 hours, for $299
A written report
All ten areas marked pass, warning or fail, what each failure means for your customers in plain words, and what it takes to fix.
A 10-minute video
Me walking through your app and the report, so you understand what I found without reading code.
The 3 biggest problems, fixed
Done in your repository as changes you approve, each with a short note on what changed and why.
A list of keys to rotate
Every secret that may have been exposed, where to rotate it, and in what order.
Client portal · Lovable + Supabase + Stripe
- FailDatabase rules: invoices table readable by any signed-in userFixed in your repo
- FailSecrets: OpenAI key in browser code, callable by anyoneFixed, key rotated
- FailPayments: Plan unlocked on the success page, not by a webhookFixed in your repo
- WarningBackups: Daily backups on, never restored, files not coveredIn the Sprint
- WarningSign-in emails: Sent from the default sender, links to old addressIn the Sprint
- PassYour domain: HTTPS on, one address, redirects correctPass
How it works
- 2 minutes
Pay $299
Card or wallet through Stripe. You get a receipt and the intake form straight away.
- 5 minutes
Give me access
Your app's address, and collaborator access to GitHub, Supabase and your hosting. Never passwords.
- Within 48 hours
Report, video, 3 fixes
I check all ten areas on your live app, fix the three most serious problems, and send the report and video.
- Your call
Stop there, or finish the job
Fix the rest yourself with the report, or book the 5-day Sprint with the $299 taken off.
You don't carry the risk
Launch Check: 3 real fixes, or your money back
If I can't find and fix at least three real problems in your app, you get the full $299 back. You keep the report.
Sprint: live in 5 working days, or your money back
If the Sprint isn't live in 5 working days from the day I have access, you get the full $1,090 back, and you keep everything I finished.
What I won't do is call your app "secure": nobody honestly can. You get, in writing, what I checked, what I fixed and what's still open. Refund policy.
Why not just ask the AI, or hire a freelancer?
| What matters | Launch Check with me | Ask the builder's AI | A report-only audit | Hire a freelancer |
|---|---|---|---|---|
| Problems fixed, not just listed | Top 3 fixed in 48 hours | Sometimes | No | Yes |
| Price known before you start | $299, fixed | Credits, until it works | Yes | Usually hourly |
| Checks your live database and Stripe, not just the code | Yes | No | Depends | Depends |
| Keeps your builder and your code | Yes, no rewrite | Yes | Yes | Often quotes a rewrite |
| Money back if it doesn't deliver | Yes | No | Rarely | Rarely |
Who you're hiring
I'm Max Zeshut, a full-stack developer. I build and run 16 live sites of my own, on Next.js, Postgres, DigitalOcean and Stripe, and I build with AI coding agents every day. I know how fast they get you to a demo, and exactly which parts they leave out. You deal with me from the first message to the last fix.
Some of the sites I run, live right now
- ppl.studioAI app: sign-in, Stripe billing, Postgres
- plana.weddingWedding planning tools with Stripe checkout
- advent.center1,100+ advent calendars reviewed and priced
- peptides.academyReference site with a dose calculator
- dupe.softwareSoftware sold once for $99
- gtasix.howGame companion guide with interactive tools
Start with a Launch Check
Start here
Launch Check
$299
One payment · results in 48 hours
- All ten areas checked on your live app
- Written report and a 10-minute video
- The 3 biggest problems fixed
- 3 real fixes, or your money back
Then, if you want it all done
Ship-it Sprint
$791 after your Check
$1,090 − $299 credit, booked within 14 days · 5 working days
- Everything on the list fixed: data rules, keys, payments, domain, email, backups, monitoring
- A handoff document a future developer can read
- Live in 5 working days, or your money back
3 of 3 Sprint slots open this week. What the Sprint covers
Prices in US dollars, paid securely through Stripe. App down or data leaking right now? Rescue, $490: I start within 24 hours.
Check your own app first
- Sign up with a fresh address on your live domain. How long until the email arrives, and is it in spam?
- Click every link in every auth email and note where it lands.
- In Supabase, check whether a custom SMTP sender is set (Authentication, then Emails) and what the site URL and redirect URLs are.
Only ever check an app you own or have written permission to test.
Found something you'd rather not fix yourself? Have me fix it, $299
Questions
Why do emails work for me but not for users?
Default senders have low hourly limits and poor reputation. Your own test address may be on an allow-list, or you just haven't sent enough to hit the limit yet.
Is it safe to give you access?
You add me as a collaborator on GitHub, Supabase and your hosting, so you can see everything I do and remove me in one click. I never ask for passwords, I don't copy your customers' data anywhere, and when I'm done you get a list of keys to rotate.
What if you don't find much?
If I can't find and fix at least 3 real problems, you get the $299 back. You still keep the report, which shows what was checked and passed.
Will you rewrite my app or make me leave my builder?
No. I fix what's there, in your repository. You keep building in Lovable, Bolt or Replit afterwards, and the report tells you what not to undo.
Who does the work?
I do, myself, every check and every fix. That's why there are only three Sprint slots a week.
Is this a penetration test?
No. I check your app's setup against a fixed list, on your own accounts, and fix what fails. I don't attack your app or anyone else's, and I won't call it "secure": you get in writing what was checked, what was fixed and what's still open.
Where are you, and how fast do you reply?
I work from Europe (CET) and reply to email within a few hours on working days. The 48 hours of a Launch Check start when I have access; a Rescue starts within 24 hours, any day.
What happens after the Launch Check?
Nothing, unless you want it to. The report is yours to fix the rest yourself or with anyone. If you book the 5-day Sprint within 14 days, the $299 comes off its price.
Find out what your app is missing, in 48 hours
A Launch Check is $299: a written report, a video walkthrough and the three biggest problems fixed. Fewer than three real fixes and you get your money back. The full price comes off a Sprint booked within 14 days.