# VibeFixKit

> Free, plain-English fixes for the errors AI-built apps hit (env vars, CORS, Supabase RLS, hydration, deploys) with a copy-paste fix prompt for Cursor, Claude Code, Codex, Lovable, Bolt, Replit and v0, plus a library of starter prompts.

Each fix page has: the exact error text, a plain-English cause, numbered fix steps, what not to do, and a copy-paste fix prompt for AI coding tools. Content last reviewed 2026-11-13.

## Fixes
- [Hydration failed: server HTML didn't match the client](https://vibefixkit.com/fix/hydration-mismatch/): The first render on the server and the first render in the browser produced different HTML.
- [useState / useEffect only works in a Client Component](https://vibefixkit.com/fix/usestate-in-server-component/): In the Next.js App Router, files are Server Components by default. Hooks and event handlers need a Client Component.
- [process.env.NEXT_PUBLIC_... is undefined in the browser](https://vibefixkit.com/fix/next-public-env-undefined/): Next.js only exposes env vars to browser code when their name starts with NEXT_PUBLIC_, and it inlines them at build time.
- [Works locally, broken after deploy: env var missing in production](https://vibefixkit.com/fix/env-works-locally-not-in-production/): .env files stay on your machine. Your host only knows the variables you add in its dashboard.
- [import.meta.env.VITE_... is undefined (Vite, Lovable, Bolt)](https://vibefixkit.com/fix/vite-env-undefined/): Vite only exposes variables that start with VITE_ to client code, via import.meta.env, not process.env.
- [My API secret is in the browser bundle](https://vibefixkit.com/fix/secret-key-exposed-in-frontend/): Anything in client-side code, including NEXT_PUBLIC_ and VITE_ variables, is downloadable by anyone. Treat that key as compromised.
- [Blocked by CORS policy: No 'Access-Control-Allow-Origin' header](https://vibefixkit.com/fix/cors-blocked/): The browser refused to give your page the response because the API didn't say your site is allowed to read it.
- [Supabase: new row violates row-level security policy](https://vibefixkit.com/fix/supabase-rls-new-row-violates/): Row Level Security is on for that table, but no policy allows this user to insert (or update) this row.
- [Supabase query returns [] with no error](https://vibefixkit.com/fix/supabase-select-returns-empty/): RLS is filtering the rows out silently. A SELECT that no policy allows returns zero rows, not an error.
- [Supabase: Invalid API key / legacy API keys disabled](https://vibefixkit.com/fix/supabase-invalid-api-key/): The key your app sends doesn't match the project, or it's a legacy anon/service_role key that has been disabled.
- [Firebase: Missing or insufficient permissions](https://vibefixkit.com/fix/firebase-permission-denied/): Your Firestore (or Storage / Realtime Database) security rules don't allow this read or write.
- [Firebase Auth: auth/unauthorized-domain](https://vibefixkit.com/fix/firebase-unauthorized-domain/): Your deployed domain isn't in Firebase Authentication's authorized domains list.
- [Error 400: redirect_uri_mismatch (Google / GitHub OAuth)](https://vibefixkit.com/fix/oauth-redirect-uri-mismatch/): The callback URL your app sent isn't exactly one of the redirect URIs registered for that OAuth client.
- [OpenAI / LLM API: 429 Too Many Requests or insufficient_quota](https://vibefixkit.com/fix/openai-429-rate-limit-quota/): Either you're sending requests too fast, or the account has no credit left. Same status code, different fixes.
- [401 Incorrect API key provided / authentication_error](https://vibefixkit.com/fix/llm-401-invalid-api-key/): The API received a key, but it's wrong, revoked, from another org/project, or mangled.
- [npm ERR! ERESOLVE unable to resolve dependency tree](https://vibefixkit.com/fix/npm-eresolve-dependency-tree/): Two packages want incompatible versions of a shared dependency (often React or Next.js), and npm refuses to guess.
- [Module not found: Can't resolve '...'](https://vibefixkit.com/fix/module-not-found-cant-resolve/): An import points at a file or package that isn't there, or a path alias the build doesn't know.
- [Build works on my Mac, fails on deploy: wrong file name case](https://vibefixkit.com/fix/case-sensitive-import-fails-on-deploy/): macOS and Windows ignore letter case in file names. Linux build servers don't.
- [Tailwind: trying to use tailwindcss directly as a PostCSS plugin](https://vibefixkit.com/fix/tailwind-v4-postcss-plugin/): Tailwind CSS v4 moved its PostCSS plugin into @tailwindcss/postcss, but your config still uses the v3 setup.
- [Tailwind classes not applying (no styles, or some classes missing)](https://vibefixkit.com/fix/tailwind-classes-not-applying/): Tailwind only generates CSS for complete class names it can find in your source files.
- [Error: listen EADDRINUSE: address already in use :::3000](https://vibefixkit.com/fix/eaddrinuse-port-in-use/): Another process (often an old copy of your dev server) is already using that port.
- [App runs but the preview is blank / unreachable (bind to 0.0.0.0 and PORT)](https://vibefixkit.com/fix/server-must-bind-0-0-0-0/): In containers and cloud hosts, your server must listen on 0.0.0.0 and on the port the platform gives you.
- [Page works until I refresh, then 404 (React Router / SPA on static hosting)](https://vibefixkit.com/fix/spa-404-on-refresh/): Your single-page app handles routes in the browser, but the host looks for a real file at /dashboard and doesn't find one.
- [Stripe: No signatures found matching the expected signature for payload](https://vibefixkit.com/fix/stripe-webhook-signature/): Stripe signs the raw request body. Your code verified a parsed or modified body, or used the wrong signing secret.
- [TypeError: Failed to fetch / ECONNREFUSED: app calls localhost in production](https://vibefixkit.com/fix/fetch-localhost-in-production/): The deployed app still points at http://localhost, which on your user's device (or the server) is not your backend.
- [Mixed Content: page loaded over HTTPS requested an insecure resource](https://vibefixkit.com/fix/mixed-content-blocked/): Your HTTPS site tried to call an http:// URL, and the browser blocked it.
- [TypeError: Cannot read properties of undefined (reading 'map')](https://vibefixkit.com/fix/cannot-read-properties-of-undefined/): Your code used a value before it existed, usually data that hasn't loaded yet or an API response with a different shape.
- [Objects are not valid as a React child](https://vibefixkit.com/fix/objects-not-valid-as-react-child/): JSX tried to render a whole object (or a Promise or Date) instead of a string, number, or element.
- [Too many re-renders / Maximum update depth exceeded](https://vibefixkit.com/fix/too-many-re-renders/): A state update runs on every render, which causes another render, forever.
- [ERR_REQUIRE_ESM: require() of ES Module not supported](https://vibefixkit.com/fix/err-require-esm/): CommonJS code (require) is loading a package that only ships ES modules (import).
- [SyntaxError: Cannot use import statement outside a module](https://vibefixkit.com/fix/cannot-use-import-outside-module/): Node is treating your file as CommonJS, but it uses import/export syntax.
- [Vercel: FUNCTION_INVOCATION_TIMEOUT / 504 on AI requests](https://vibefixkit.com/fix/vercel-function-timeout/): Your serverless function ran longer than its maximum duration, which is common when waiting for a long LLM response.
- [Build failed: Type error (passes in dev, fails in next build)](https://vibefixkit.com/fix/typescript-build-type-error/): Dev mode is lenient about types; production builds run the type checker and stop on errors.
- [GitHub: Push cannot contain secrets (GH013 push protection)](https://vibefixkit.com/fix/github-push-protection-secret/): GitHub found an API key or token in your commits and blocked the push. Good: it stopped a leak.
- [The engine "node" is incompatible / unsupported Node version on deploy](https://vibefixkit.com/fix/node-engine-version-mismatch/): Your host is building with an older (or different) Node.js than your packages need.
- [The AI keeps 'fixing' the same bug and making it worse](https://vibefixkit.com/fix/ai-fix-loop/): Each blind retry adds more code and more guesses. Stop patching and get a diagnosis first.

## Prompts
- [Project kickoff: spec → plan before any code](https://vibefixkit.com/prompts/project-kickoff-plan/): Make the AI write a short spec and build plan you can approve before it touches a file.
- [Project rules file (AGENTS.md / CLAUDE.md / Cursor rules)](https://vibefixkit.com/prompts/agents-md-rules-file/): A starter rules file so your agent follows the same conventions every session.
- [Diagnose before fixing (break the AI fix loop)](https://vibefixkit.com/prompts/diagnose-before-fixing/): Forces evidence before edits. Use it the second time the same error shows up.
- [Make one small, safe change](https://vibefixkit.com/prompts/small-safe-change/): Keeps an agent from rewriting half your app for a one-line request.
- [Add tests to a feature that already works](https://vibefixkit.com/prompts/write-tests-for-feature/): Lock in working behaviour so the next AI edit can't silently break it.
- [Pre-launch security review for a vibe-coded app](https://vibefixkit.com/prompts/pre-launch-security-review/): A checklist-driven review of the mistakes that most often leak data in AI-built apps.
- [Deploy readiness check](https://vibefixkit.com/prompts/deploy-readiness-check/): Catches the env-var, build and URL problems that break apps right after deploy.
- [Speed pass: make the page load fast](https://vibefixkit.com/prompts/performance-pass/): Targets the usual culprits in AI-generated frontends: huge images, heavy libraries, and blocking scripts.
- [SEO + AI-search pass for a site](https://vibefixkit.com/prompts/seo-and-llm-pass/): Adds the basics that help both search engines and AI assistants understand and cite your pages.
- [Landing page with a waitlist](https://vibefixkit.com/prompts/landing-page-waitlist/): One fast page with a headline, benefits, and an email waitlist. Good for validating an idea before building it.
- [SaaS starter: auth + database + per-user data (Supabase)](https://vibefixkit.com/prompts/saas-starter-supabase-auth/): Sign-up, login, and a dashboard where each user only sees their own records, with RLS done right from day one.
- [Simple CRUD app that saves to the browser](https://vibefixkit.com/prompts/crud-app-local-first/): A to-do / notes / tracker app with no backend. It's the fastest way to ship something useful.
- [Habit tracker as an installable PWA](https://vibefixkit.com/prompts/habit-tracker-pwa/): A phone-friendly habit tracker you can install to your home screen, with offline support.
- [Chrome extension (Manifest V3) starter](https://vibefixkit.com/prompts/chrome-extension-mv3/): A popup + content script extension using Manifest V3, the current Chrome extension platform.
- [AI chat app with streaming responses](https://vibefixkit.com/prompts/ai-chat-app-streaming/): A ChatGPT-style chat UI that streams tokens from your own server route, so your API key stays secret.
- [Chat with your docs (simple RAG)](https://vibefixkit.com/prompts/rag-chat-with-docs/): Upload PDFs or markdown, ask questions, and get answers with citations to the source passages.
- [Stripe Checkout + webhook to unlock a purchase](https://vibefixkit.com/prompts/stripe-checkout-webhook/): Sell a digital product or plan with Stripe-hosted Checkout, then unlock access when the webhook confirms payment.
- [Developer / creator portfolio site](https://vibefixkit.com/prompts/portfolio-site/): A fast personal site with projects, writing, and contact links.
- [Internal dashboard with charts and filters](https://vibefixkit.com/prompts/admin-dashboard-charts/): Turn a CSV or database table into a dashboard with KPIs, charts, filters, and an export.
- [Discord bot with slash commands](https://vibefixkit.com/prompts/discord-bot-starter/): A Node.js Discord bot with slash commands, ready to host on a small always-on server.
- [MCP server: give your AI tool a custom tool](https://vibefixkit.com/prompts/mcp-server-starter/): A minimal Model Context Protocol server that exposes one useful tool to Cursor, Claude, and other MCP clients.
- [Simple AI agent with tools (no framework)](https://vibefixkit.com/prompts/ai-agent-tool-loop/): A readable agent loop: the model picks a tool, your code runs it, results go back until it's done.
- [Storefront page for a digital product](https://vibefixkit.com/prompts/digital-product-storefront/): A simple sales page for templates, prompt packs, or ebooks that links to a hosted checkout.
- [Browser arcade game (HTML canvas)](https://vibefixkit.com/prompts/browser-game-canvas/): A complete small game loop: input, movement, collisions, score, and restart. No engine needed.
- [Idle / clicker game with offline progress](https://vibefixkit.com/prompts/idle-clicker-game/): Upgrades, exponential costs, autosave, and offline earnings: the core systems of an idle game.
- [NASA Astronomy Picture of the Day viewer](https://vibefixkit.com/prompts/nasa-apod-viewer/): Browse NASA's APOD by date, with explanation text, favourites, and a random button.
- [Upcoming rocket launches + countdown](https://vibefixkit.com/prompts/rocket-launch-countdown/): A list of upcoming launches with live countdowns, using a public launch data API.
- [Live ISS position map](https://vibefixkit.com/prompts/iss-tracker-map/): Show where the International Space Station is right now on a world map, updating every few seconds.

## Optional
- [Full text of every fix and prompt](https://vibefixkit.com/llms-full.txt)
- [About](https://vibefixkit.com/about/)