Harden a Rocket.new MVP before paid traffic (2026)

Citation-ready answer: Harden a Rocket.new MVP before paid traffic by treating Staging Launch as the lab and the Production custom domain — or the one `builtwithrocket.new` host you actually advertise — as the only stranger URL. Keep Stripe live keys and connector secrets on the Production env tab, never in Chat. Require Auth on mutating Supabase and Stripe routes; a Visual edit hide is paint. Name Unpublish as the off switch, not Rollback. Then buy ads.

This note is from CodeCross, an Austin, Texas app development company (Pakistan engineering on a US Central overlap). Other tools sit on vibe coding. Buying help is the Austin app development company page. If nobody can name Unpublish tonight, book a conversation.

Money leaves when the campaign still lists a Staging URL, a Stripe live key that lived in Chat, or a Build task that is Public because the Free plan cannot make it Private. Pricing puts Pro at $25 a month for 100 credits, Rocket at $50 for 250, and Booster at $250 for 1,500. Annual billing is 20 percent off. That fee buys credits, ZIP download, Private visibility, and Unpublish. It does not buy a sealed Production env tab. Credits are honest: one balance covers Chat, Build, and Intelligence. There is no separate bill for compute, storage, or hosting. A stranger hitting your OpenAI connector still burns *your* key. A Chat turn to “fix the leak” still burns *your* credits.

This essay is the week before you buy ads, while the site still Launches from Rocket.new. Close the risky doors while the host still writes the tree. It expands Harden a Public Rocket.new Build Before Campaigns. This page is not Rocket.new to production, get off Rocket.new, migrate from Rocket.new, or transition from Rocket.new. The question here is narrower: can you buy a click while Rocket.new still owns Launch and the Staging URL? When secrets, Unpublish, or the advertised origin is still open, book.

Stay on Rocket.new. Close the doors first.

Rocket.new is paid to finish a Build tonight. Paid traffic is paid to send strangers at a public URL. Those jobs collide. A green Staging Publish can still leave a Stripe live key on the Staging env tab, a Public Build task anyone can open, or a leftover `builtwithrocket.new` name as the share link.

The vendor’s own docs draw the line. Launch your site opens a dialog with Staging and Production tabs. Staging publishes the current build. There is no version dropdown on that tab. Production is a second click: pick a version, attach a custom domain, fill the Production env tab first. Switching the tab does not close a connector. You still pick who may call a mutating Supabase route. You still pick which URL ads will hit.

Custom domain is a paid door (Pro or above). Rocket hosts on its Vercel account by default. Connect your own Netlify account and it deploys there instead. You do not need a new builder this week. You do need to name who holds the Production env tab, who can click Production Launch, and which URL ads will hit.

Rank the blast. Ads make a small leak big.

Start with the blast, not a prettier home screen. A stranger who dumps every order row, burns a paid OpenAI connector from a public route, or copies a live Stripe secret will cost more than a new landing page. Rank those doors. Close the worst one tonight.

Put six names on paper: who owns the Production env tab, who proves login on the advertised URL, who can click Production Launch, who watches credits and connector spend after a Launch, who owns the public origin, and who can Unpublish tonight. Two red names plus a campaign date means spend stays off. If you cannot name a human for each layer, book.

Staging Launch is the lab. Production is the ad target.

Rocket.new gives you several addresses that look live. They are not the same job.

Launch your site is honest about the share door. Click Launch. Stay on Staging. Click Publish. You get a staging URL. Click Update any time to push the current build to the same URL. Staging has no version dropdown. Versions call Staging a private preview, not visible to end users. Production is the live app, visible to everyone with the URL. Launching a labeled version from chat does not move your editor. It only changes the deployed environment.

Custom domain is the Production path. Pick a version. Type the domain. Rocket prompts you to set the Production Environment before it touches DNS. Once a version is live, you only move forward to newer versions. To go back, Unpublish and publish again from that version. DNS can take up to 48 hours. Do not buy ads on a domain that still points at the wrong A record.

Google Ads destination mismatch rejects an ad when the display URL domain does not match the final URL. Do not advertise your custom domain if clicks still land on a leftover `builtwithrocket.new` slug. Do not advertise Production if the final URL is still Staging. Point ads, mail, and in-app shares at one name you proved.

Env tabs: Staging values are not Production values.

Keys are the next thing ads will leak. Environment variables keep separate values for Staging (while you build) and Production (when you launch). Open the task name → Settings → Environment. Two tabs. Fill both. If you set a value in code or in a connector’s value field instead of this panel, Rocket treats it as a staging value by default.

Web tasks use `.env`. Mobile tasks use `env.json` — there is no Environment panel for mobile; you edit the file or the connector field. Add new names in the `.env` file with placeholders. Put real secrets only in the Environment panel. `NEXT_PUBLIC_` names ship to the browser. Security checklist is blunt: `NEXT_PUBLIC_SUPABASE_URL` and the anon key are meant to be public. `STRIPE_SECRET_KEY`, `OPENAI_API_KEY`, and `service_role` are not. Search the tree for `sk_`, `key_`, and `secret` before you Launch.

Stripe says never paste keys into Chat. Use the Connect popup. Start with Test keys. Switch to Live keys only when you are ready to take money. One set of keys per task. Connect Supabase first — Rocket ties Stripe customers to Auth users. Stripe’s API keys guide is the same split: `pk_…` can sit in the page. `sk_…` cannot. If a live secret sat in Chat, in a custom-code snippet, or only on the Staging tab, rotate it before ads. If the only place the secret still lives is a prompt history you will not search, book.

Connectors and Auth: a hide in Visual edit is not the lock.

Rows and money paths are the first thing ads will leak. Rocket.new is good at drawing a checkout in Chat or Visual edit. It is weaker at naming who may call the route after that checkout. Security checklist says protect every API route that creates, updates, or deletes data. Enable Auth on any page that shows user-specific data. Redirect the logged-out visitor. Then prove the function, not the page.

Supabase is a workspace-level connector. One project per task. Use Edge Functions when a secret must not reach the client. Their own prompt for per-user data is the right test: “Add row-level security so users can only read and edit their own records.” OWASP Top 10 2025 still ranks broken access control first. They found some form of it in 100% of apps they tested. One example is an admin check that lives only in the front end. A Visual edit hide is that example.

Tell Chat to require a logged-in user on every route that reads or writes money or personal data. Then prove it. Call the route logged out. You want a refusal, not a row. Then call it as user B against user A’s order. You want a refusal again. A green Preview as the founder is not that proof. Never put `service_role` in client code — it bypasses RLS entirely.

Redirect URLs default confirmation, reset, and magic links to `http://localhost:3000`. If you Launch without changing Site URL, the stranger lands on a broken page. Set Site URL to the advertised host — `https://your-app-name.builtwithrocket.new` or `https://yourdomain.com` — with `https://` and no trailing slash. Test a fresh signup. The mail must open the ad host, not localhost, not Staging.

Task visibility and who may Launch.

Task visibility is per Build task. Public: anyone with the link can view the output. Anonymous viewers stay view-only. The owner and people with edit access can Chat and iterate. Public tasks show a “Built with Rocket” badge. Private: hidden from people who do not have access, even if they have the URL. Private requires Pro. Free plan tasks are always Public.

Flipping Private to Public exposes the entire task history — every message and output — immediately. Review Chat before you make a task visible. Existing public links die when you go Private. That is a door on the *task*, not on the Launch URL. A stranger who never opened the task can still hit Production if you published it.

Share with Remix is a different door. Creating a remix link needs Pro. Anyone with the link can clone the Build for free — screens, code, which connectors you used. Environment variables are stripped. Hardcoded secrets are not. If a key lived in a file instead of the env tab, Remix copies it. Do not treat a remix invite as a campaign asset.

Task collaboration lets the owner invite an Editor or a Viewer on one task. Editors can Chat and iterate. Viewers cannot. Workspace Editors can also connect and disconnect services, and they get a credit limit (default 100, range 0–10,000). Launch sits on the task. Name the humans who may click Staging Publish and who may click Production. An Editor with a high credit cap and a Launch button is a blast radius, not a convenience.

Credits burn on Chat. Hosting is not owned compute.

Credits are the usage currency. Chat messages, new Builds, Solve reports, and Intelligence setup all draw from one balance. Hosting is included — there is no separate compute bill while Rocket still Serves the Launch. That sentence is a trap if you read it as “ads are free.” Credits pause generation when the balance hits zero. They do not pause a stranger calling your OpenAI connector. They do not pause Stripe live charges.

The week ads go live, cap two meters. First: who may send Chat (Editor credit limits). Second: which connector keys a stranger can exercise. A Public mutating OpenAI route is not a Rocket credit problem. It is your API bill. Owned compute — a ZIP or GitHub tree that `npm install && npm run dev` on a laptop with the Rocket tab closed — is how you stop paying credits for every hotfix. It is not how you take Production offline. That is Unpublish.

ZIP and GitHub: a cold boot is proof. It is not the off switch.

Default rows and the live URL still live with Rocket until you prove a tree you can start without the editor. Code Download exports a `.zip` on Pro or above, web browser only. Mobile can browse files and push GitHub; it cannot download. The ZIP holds source, config, and environment *templates* — placeholder values. Fill real keys before you run. `npm install && npm run dev` for Next.js. `flutter pub get && flutter run` for Flutter. The archive is a snapshot. It does not sync later Chat turns.

GitHub is a workspace connector. Next.js TypeScript gets two-way sync: Push writes `rocket-update` and opens a pull request to `main`. Pull reads `main` back into the task. Other frameworks are one-way Push. A green PR is a backup. It is not Unpublish. It is not a host you run. Prove the cold boot once: editor closed, ZIP or clone opened, placeholders replaced, primary journey completes. Then you know you *could* leave. This page does not make you leave.

Off switch: Unpublish. Not Rollback.

A bad Launch needs an off switch you can name tonight. Asking Chat to “fix it” waits on a prompt and burns credits. That is repair. It is not an off switch.

Launch your site names the switch. On the Staging tab, click Unpublish. The link stops working immediately. You can republish later. Unpublish requires Pro or above. Name the person who can open Launch. Hit Unpublish once in a safe window so you know the control works. Then turn it back on. Production’s undo is the same family: Unpublish, then publish the earlier version. Custom domain says you cannot walk a live version backward without that unpublish step.

Versions split a second drawer. Every Chat reply saves a version. Rollback reverts the *editor* to that version and discards everything after it. Labels die with the discarded versions. This cannot be undone. Rollback does not Unpublish. Launch on a version can deploy that snapshot to Staging or Production without moving your working tree. A Rollback you have never clicked is folklore. A Chat turn that says “undo the Launch” is not Danger Zone.

Watching: the primary journey after a bad Launch.

Watching without an off switch is half a lock. Before ads, name three signals: sign-in failures on the advertised URL, the primary money or lead path after a Production Launch, and credit plus connector spend. Code view Logs are the lab. They are not the stranger meter. Name who watches the Production URL the first day ads run.

A Staging Publish can look fine and then miss Production env. Remember the split: two tabs, two values. If the campaign lands on an empty catalog because Production never got the Supabase URL, that is a watch miss, not a creative miss. Prove the advertised origin on a cold load, signed out, then as a fresh account, before you buy a click that lands there.

Score each row against the advertised URL, not Staging. One red cell — a mutating route without Auth, a key in Chat, a Staging ad, a Public task treated as a lock, a ZIP you have never booted, or an Unpublish you have never hit — is enough to hold the spend. Move that cell. Do not greenwash the matrix.

The week before you buy ads

Treat the next seven days as operator time on the Rocket.new task, not a slogan. Inventory who can Production Launch, who holds the Production env tab, and which origin ads will hit. Then seal. Then prove.

Day 0 is inventory. Write five facts. The public origin. The person who can Production Launch. Whether a live key still sits in Chat or only on Staging. Whether a stranger can call a mutating connector. Whether you can Unpublish tonight. If the public origin is already taking leads and you cannot name those five, stop. You do not need a new screen. You need this list.

Seal connectors first. Then env tabs. Then the URL. Bots do not wait for a nicer landing page. If a public payment route exists, prove it refuses the call when the stranger is logged out. Then strip leftover Staging shares. Then Unpublish once in a safe window so you know the off switch works. Then spend. This page is the week you run that list.

Treat those bars as calendar you reserve, not a vendor promise. If you cannot name the advertised origin, who can Production Launch, and who can Unpublish, the later days will thrash. The long bar is the expensive miss: a “small” test while a mutating connector or a Chat secret is still the company.

Stay on Rocket.new, or leave. Do not mix the two jobs.

Pick one job for this week. Stay keeps Rocket.new as the studio, with sealed connectors, Production env filled, a Production URL as the origin, and Unpublish already proved. Leave opens get-off Rocket.new and stops buying clicks that need that Launch window.

If you only need a leave date, use when to leave an AI builder. A door that will not close belongs on rewrite vs harden. A personal Git remote belongs on GitHub handoff. A host-only ship path belongs on CI/CD after an AI builder. Cousin wraps: Create.xyz, FlutterFlow, Cursor, Emergent. Those pages are not this Rocket week.

When the list turns red

Leave the product up. Kill the campaign if any of these are still true:

• A money or personal-data route is still callable logged out, or a stranger can read another user’s row.
• A live key still exists in Chat, in custom-code, or only on the Staging env tab.
• Ads, mail, or Auth still list Staging, localhost, or a leftover `builtwithrocket.new` name you do not mean to keep.
• The only restore is “we will Rollback,” and you have never cold-booted the ZIP with the editor closed.
• The off switch is another Chat turn, or you have never hit Unpublish (and you are still on Free, so you cannot).
• Two people disagree about who can Production Launch or who holds the Production env tab.

A single red door is a miss, even if Staging is green. Stop adding screens until connectors, env tabs, the origin, and Unpublish are honest. Finish those doors. Then spend — or open get-off Rocket.new if the host is still the company.

Bring a second pair of hands when the founder cannot rotate a key without pasting it back into Chat, when a stranger can still call a mutating connector, or when nobody has hit Unpublish before the date. Hire for Auth on routes, Production env, Launch seats, and the URL map — not a prettier home screen. Austin app development company is the studio brief. Austin web development if the next door is a published URL that still points at this Rocket.new host. Austin mobile app development if a Flutter web preview or store build still depends on the same backend Launch.

Next steps

Walk the gates in order. Inventory the public origin, the person who can Production Launch, and who holds the Production env tab. Drain Chat into Environment tabs. Rotate anything that appeared there. Require a logged-in user on money and personal-data routes. Prove a stranger test on the live URL. Cold-boot the ZIP with the editor closed. Hit Unpublish once. Then buy the click — or open the exit if the process itself must leave Rocket.new.

CodeCross LLC is an Austin-registered product studio (1606 Headway Cir STE 9212, Austin, TX). The Rocket.new week we run is sealed connectors, Production env filled, a Launch URL you own, a ZIP you have already started, then Unpublish you have already hit. The Austin app development company page is the studio brief. Austin web development is the published-URL door if strangers still hit this Rocket.new host. Company-level evidence lives on proof. When the off switch, secrets, or the advertised origin is still open, book a conversation.

Rocket.new is allowed to stay the studio. Ads are not allowed to treat a Staging Publish, an open connector, or an unreviewed Chat secret as that proof. Show Unpublish you can hit, rows that refuse a stranger who is not the owner, and keys that never lived in Chat. Most teams never need a second codebase once those three exist.

FAQ

Does a green Rocket.new Staging Publish mean ads can use the Production custom domain?

No. Launch your site keeps Staging and Production on separate tabs with separate environment variables. Staging publishes the current build and has no version dropdown. Production needs a version, a custom domain, and the Production env tab filled first. A founder click on Staging does not prove a stranger on the advertised host. Prove the money path signed out, then as a second account, on that host.

If I hide checkout in Visual edit, can a stranger still hit the Stripe or Supabase mutating route?

Yes, if the route stayed callable. Security checklist says protect every API route that creates, updates, or deletes data. Supabase wants RLS plus Edge Functions for secrets. A Visual edit hide is paint. Call the route yourself without a cookie. Then call it as user B against user A’s order.

Does setting the Build task to Private stop one signed-in stranger from reading another user’s row?

No. Task visibility hides the *task* — Chat, files, the editor link — from people without access. Private needs Pro. Free tasks stay Public. Visibility does not put RLS on Supabase or an owner check on a Stripe webhook. A stranger who never opened the task can still hit Production if you Launched it. Prove user B cannot read user A’s row on the advertised URL.

If I Rollback a Rocket.new version in chat, does the Production URL go back?

Not by itself. Versions Rollback reverts the editor and discards later versions. It does not Unpublish. Launch your site Unpublish takes the staging URL offline (Pro or above). Production’s undo is Unpublish, then publish the earlier version. “We will Rollback” waits on Chat and burns credits.

Is downloading a ZIP or pushing GitHub the same as Unpublish I can hit tonight?

No. Code Download gives you a snapshot with placeholder env values. GitHub Push is a backup — two-way for Next.js TypeScript, one-way otherwise. Neither takes the live URL down. Unpublish on the Launch dialog does. Cold-boot the ZIP once so you know you *could* leave. Hit Unpublish once so you know you can stop ads tonight.

Can I advertise my custom domain if Auth still sends magic links to localhost or a leftover builtwithrocket.new slug?

No. Redirect URLs default Site URL to `http://localhost:3000`. Set it to the advertised host — custom domain or the one `builtwithrocket.new` name you mean to keep. Google Ads destination mismatch rejects an ad when the display URL domain does not match the final URL. Do not mix Staging, localhost, and the campaign door.