real-systems

39 articles · newest first

Isometric diorama of data flowing through pipes, one narrow section causing a backup

Your Lovable app got slow as the data grew. Three usual reasons.

It was snappy with ten rows and crawls with ten thousand. Almost always it's one of three things — a missing index, fetching everything then filtering in the browser, or no caching — and none needs you to read code.

Aliteq Team · Sep 26 · 6 min

Editorial infographic of a wide desktop layout reflowing into a tall phone layout with a viewport tag highlighted, near-black background with indigo-violet and a coral accent

Build

"Make this page work on phones": the one tag most prompts forget

Ninety percent of "it's tiny on mobile" is one missing tag. Here's "make this page work on phones" three ways, with the real code — from a lonely media query to a proper mobile-first layout.

Aliteq Team · Sep 26 · 6 min

Realistic painterly illustration of a single glowing envelope rising into a dawn sky over a quiet skyline, deep indigo with a warm coral sunrise accent

Build

"Send a daily summary email": the prompt that avoids the spam list

A naive "send a daily email" loop fires at the wrong time, breaks on one bad address, and can email someone a hundred times. Here's the request three ways, with the real code, and the guards that keep you off spam lists.

Aliteq Team · Sep 26 · 6 min

Isometric diorama of a grid of table rows each with its own small lock, one row highlighted, near-black background with indigo-violet and a coral accent

Build

"Write the RLS policy for my users table": three prompts, three outcomes

Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.

Aliteq Team · Sep 26 · 6 min

Editorial infographic of a safe checkout flow: browser to a server holding a locked key, then a verified webhook, near-black background with indigo-violet and a coral accent

Build

"Add a Stripe checkout button": the prompt that leaks your secret key

The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.

Aliteq Team · Sep 26 · 6 min

Isometric diorama of a glowing key turning in a login card, near-black background, indigo-violet with a small coral accent

Build

"Add login with Supabase": the same prompt, three ways

Every vibe coder types "add login with Supabase" and gets working code. Here's what changes when you ask for it vaguely, specifically, and with the guardrails spelled out — with the real code each version produced.

Aliteq Team · Sep 26 · 6 min

real-systems

Your Lovable app got slow as the data grew. Three usual reasons.

"Make this page work on phones": the one tag most prompts forget

"Send a daily summary email": the prompt that avoids the spam list

"Write the RLS policy for my users table": three prompts, three outcomes

"Add a Stripe checkout button": the prompt that leaks your secret key

"Add login with Supabase": the same prompt, three ways

One script, 10,000 fake signups overnight: the guardrail most vibe-coded apps ship without

It worked with ten users. Then a hundred showed up at once.

Don't make the user wait for the slow part — hand it to a queue

You fixed the typo. Visitors still see the old version. Here's why.

Your app is fast for you and slow for everyone else — the reason is geography

Your app broke and you have no idea why. It left you a note.

Every photo, row and document your app saves is one thing: a named box of bytes

The chip reading every instruction, billions of times a second

Your app got busy and crashed — it ran out of desk space

When you vibe code, this is what the AI is actually writing

"The cloud" is someone else's computer, rented by the minute

The free speed trick your app already gets — and exactly where it stops

Free until people show up: what a live app actually costs

Shipping without the padlock is the mistake — here's the name and the lock

Before you hit deploy: what that button actually promises the world

The app knows who you are — that's not the same as what you're allowed to touch

"Sign in with Google" never gives the app your Google password — here's the trade

The wristband that keeps you logged in — and what happens if someone copies it

A good app can't email you your own password — that's the feature

Logging in doesn't prove you're you — it proves you hold something

AI deleted my database. Can I get it back?

Supabase: the backend-in-a-box behind so many AI-built apps

A query with no "only" returns everyone's data — here's how that happens

The shape of your data: tables, rows, and the one column that links everything

Where your app actually keeps every sign-up, order and message

The dining room and the kitchen: which half of your app anyone can read

An API is a menu of requests a server agrees to accept — order off it

Where your tap lands: the always-on computer that answers — and can see your secrets

Every tap sends a tiny message to a stranger's computer — this is what's inside

Your phone knows a name, not an address — DNS is how it finds the site

The address bar is doing four jobs at once — here's each one

The half of your app you can't see — and why every security rule has to live there

The one file you must never commit — and the trap that ships secrets to the browser