Harden a Tempo MVP before paid traffic (2026)

Harden a Tempo MVP before paid traffic by treating Canvas, Chat worktrees, and Play on localhost as the lab, and one advertised origin you already proved — your custom domain or the host that builds from the default branch — as the only stranger door. Keep Stripe secret keys out of VITE_ names and out of committed .env. Require owner rules on money rows. Name a host halt, not Discard. Then buy ads.

This note is from CodeCross, an Austin, Texas app development company (Pakistan engineering on a US Central overlap). Other tools sit on vibe coding. Buying help is the Austin app development company page. If nobody can name a host halt tonight, book a conversation.

Money leaves when the campaign still lists a Canvas Play tab, a Stripe secret named `VITE_`, or a leftover branch-live share link. Pricing puts Free at $0 with 250 issues, 100 docs, 500 local tests a month, and 7-day history. Pro is $50 a month for one user: unlimited issues and docs, 5,000 tests, 90-day history, and $4.50 per 1,000 extra tests. Extra seats are $40. Team is $200 a month for five users and 35,000 tests. That fee buys the desktop IDE, Canvas, Chat worktrees, and Agents. It does not buy a sealed host, a row rule, or an off switch you can hit after you quit the app.

This essay is the week before you buy ads, while screens still move in Tempo. Close the risky doors while Canvas still writes the tree. It expands Tempo MVP hardening. This page is not Tempo to production, get off Tempo, migrate from Tempo, or transition from Tempo. The question here is narrower: can you buy a click while Tempo still owns Canvas, Chat, and the Agents that open pull requests? When secrets, a host halt, or the advertised origin is still open, book.

Stay in Tempo. Close the doors first.

Tempo is paid to turn feedback into reviewed pull requests. Paid traffic is paid to send strangers at a public host. Those jobs collide. A green Canvas Play session can still leave a service key in a `VITE_` name, a table with no owner rule, or a branch-live share link as the campaign URL.

The vendor’s own docs draw the line. Introduction calls Tempo an AI software factory: Docs, Canvas, Issues, Chat, and Agents share one codebase. Canvas is blunt. Every frame is a live iframe of a real Vite or Next route. Style edits write back to source. That is the lab. Chat runs Claude or Codex in an isolated git worktree so the agent never touches your main tree until you merge. You still pick who may read a row on the host ads will hit. You still pick which origin those ads will open.

On 14 June 2026 Tempo wound down the web editor. The new path is a desktop app on your machine. app.tempo.build stays as a read-only billing portal. Old web repos were kept for 60 days after that date. That window is closed. If you never cloned, treat the web-era tree as gone unless a GitHub remote still answers. You do not need a new builder this week. You do need to name who holds secrets, who can merge to the default branch, and which URL ads will hit.

Fix the worst risk first. Ads turn a small leak into a big one.

Start with the worst risk, not a prettier storyboard. A stranger who dumps every order row, copies a live `sk_live_` from a `VITE_` bundle, or follows a branch-live share into an unreviewed worktree will cost more than a new onboarding flow. Put those risks in order, worst first. Close the worst one tonight.

Put six names on paper: who owns secrets, who proves login on the advertised host, who can merge to the default branch, who can enable Agents, who owns the public origin, and who can halt that host tonight. Two red names plus a campaign date means spend stays off. If you cannot name a human for each layer, book.

Canvas and Chat are the lab. The default-branch host is the ad target.

Tempo gives you several surfaces that look live. They are not the same job.

Canvas starts your dev server in the background. Iframes point at that server. Every design edit is a file write. Storyboards live as typed React exports under `tempo/designs/canvases/`. They commit like any other file. A Play session that looks finished is still localhost unless you pointed ads at something else on purpose.

Product updates added commit-aware preview publishing and branch-live share links. Reviewers see the state that matches a given branch. That is a gift for pull requests. It is a trap for ads. Install the Tempo MCP can mint those shares from CI if a `TEMPO_AUTH_TOKEN` sits in the job. Share links need the canvas branch committed and pushed. Do not treat a reviewer link as a campaign asset.

Google Search Central wants one preferred URL when two hosts show the same app. Meta’s ad review also checks the destination. Do not advertise your custom domain if clicks still land on a leftover `app.tempo.build` tab or a branch-live share. Point ads, mail, and in-app shares at one name you proved.

Secrets: VITE_ is the browser. Everything else stays on the host.

Keys are the next thing ads will leak. Setup and run scripts keep values out of the tree. The project env panel holds what your app reads from `.env`. A Private Setup Script can symlink `.env.local` from `$TEMPO_SOURCE_PATH` so the file never leaves your machine. The Workspace Setup Script is shared when you commit `tempo.config.json`. Do not put a live secret in that file.

Vite env and modes is the split Tempo Canvas actually runs. A name that starts with `VITE_` is baked into the client bundle. Everything else stays off the browser unless you prefix it. Stripe API keys say only a publishable `pk_` key is safe to expose. A secret `sk_` or a restricted `rk_` belongs in a host vault, not in Canvas chat and not under `VITE_`. If a live secret sat in chat, in a committed `.env`, or under a public prefix, rotate it at the provider first, then update the host, then ship a new build. Reloading Play is not enough.

Changelog notes that Canvas variables now run in production builds. Treat every canvas variable as if a stranger can read it. Install the Tempo MCP mints a `tempo_…` token for cloud agents and CI. Writes act as you. Revoke tokens you stop using. If the only place the secret still lives is a Chat transcript you will not search, book.

Auth and rows: a Canvas hide is not the lock.

Rows and money paths are the first thing ads will leak. Tempo is good at drawing a checkout on a storyboard. It is weaker at naming who may read the row after that checkout. Canvas writes React. React will hide a button if you ask. Hiding a control in a frame is paint. The API still answers.

OWASP Top 10 2025 still ranks broken access control first. They found some form of it in 100% of apps they tested. One example is an admin check that lives only in the front end. A Canvas hide is that example. Supabase Row Level Security is the common store behind Tempo-emitted apps. Policies name `auth.uid()`. A storyboard that looks empty for user B is not a policy.

Prove the function, not the frame. Call the route logged out. You want a refusal, not a row. Then call it as user B against user A’s order. You want a refusal again. A green Canvas Play as the founder is not that proof. Never put a `service_role` key in client code — it bypasses RLS entirely.

Agents act as you. Born disabled is not the same as off.

Agents are standing prompts on a trigger. Slack, GitHub events, schedules, or an assigned issue can start a Tempo session on your machine. Two safety lines matter. A new agent never fires until you enable it. And an agent acts as you, with your access. Nothing runs while Tempo is closed. That last sentence is a trap if you read it as “ads are safe when I quit.” The advertised host still answers. Agents only stop opening new pull requests.

Templates arrive disabled. Slack and GitHub triggers need a one-time connection. Name who may enable an agent the week ads go live. A Member in a team org can see and edit everything and can invite others. Only an Admin can remove members. Invite Agents as if they can merge — because they can open the PR that your host already auto-deploys.

Visual Review is pixels. It is not a row rule.

Visual Review turns tracked storyboards into a regression test. Mark a board with the `vrt` prop. Every pull request pixel-diffs it against the default branch. The `visual-review` check stays red until a person approves each change in Tempo’s portal. That is a real gate for layout. It is not a gate for “user B cannot read user A’s order.”

Two escape hatches are deliberate. The `visual-review:bypass` label posts success without capturing. A no-visual-change marker in the PR body skips capture when you are sure the PR touches no tracked board. Never put that marker in a PR template. Protected branches should require `visual-review` from Any source or the Tempo Labs AI GitHub App — never from GitHub Actions alone, or approvals cannot flip the check. A passing pixel check plus a campaign date is still red if a stranger can read a row.

Who may merge, and who can enable Agents.

Organizations and workspaces nest org, project, workspace, and worktree. A team org requires a GitHub or GitLab remote. A private org can stay local-only. Local-only is a lab. It is not a campaign path. Docs, issues, canvases, and chat history live with the org. Switching orgs changes what you see and moves nothing.

Name the humans who may merge to the default branch, who may enable Agents, and who holds the Tempo Labs AI GitHub App. A Member with edit access and an enabled Agent is a blast radius, not a convenience. Collaborators spend the same model seats you pay for. Treat every extra Pro seat as someone who can push.

GitHub: a cold boot is proof. It is not the off switch.

Default rows and the live host still live with your deploy until you prove a tree you can start without Tempo. Chat merge controls bring a worktree back to main or open a PR. The agent runs `git push`. Worktrees use a throwaway branch named `{your-git-username}/{workspace-slug}`. Discard runs `git worktree remove` and deletes that branch. Your local root never saw the change.

A green push is a backup. It is not a host halt. Secrets in the env panel never land in Git unless you committed them. Host rows are not in Git. Store certificates are not in Git. Prove the cold boot once: Tempo closed, clone opened, placeholders replaced, primary journey completes. Then you know you *could* leave. This page does not make you leave.

Off switch: halt the host. Not Discard.

A bad launch needs an off switch you can name tonight. Asking Chat to “fix it” waits on a prompt and burns model credits. That is repair. It is not an off switch.

Discard is a different drawer. Chat says Discard drops the worktree and nothing is lost on main. That is true for an unmerged session. It is false for a host that already built the merge. A branch-live share stays up until you stop publishing that commit. Name the person who can open the host dashboard. Hit halt or rollback once in a safe window so you know the control works. Then turn it back on.

Agents stop when Tempo is closed. That is not a campaign halt. The advertised URL still serves the last deploy. A Chat turn that says “undo the upload” is not Danger Zone.

Watching: the primary journey after a bad launch.

Watching without an off switch is half a lock. Before ads, name three signals: sign-in failures on the advertised origin, the primary money or lead path after deploy, and Agent plus test spend. Pricing meters local tests. Pro overage is $4.50 per 1,000. Visual Review captures burn that meter. Canvas Play logs are the lab. They are not the stranger meter. Name who watches the advertised URL the first day ads run.

A green storyboard can look fine and then miss a rule that went live the moment the default branch deployed. If the campaign lands on empty screens because RLS still uses the founder’s user id, that is a watch miss, not a creative miss. Prove the advertised origin on a cold install, signed out, then as a fresh account, before you buy a click that lands there.

Score each row against the advertised origin, not Canvas Play. One red cell — a mutating route without an owner rule, a key in chat, a Canvas ad, a Member treated as a lock, a repo you have never booted, or a halt you have never hit — is enough to hold the spend. Move that cell. Do not greenwash the matrix.

The week before you buy ads

Treat the next seven days as operator time on the Tempo project, not a slogan. Inventory who can merge, who can enable Agents, and which origin ads will hit. Then seal. Then prove.

Day 0 is inventory. Write five facts. The public origin. The person who can merge. Whether a live key still sits in chat or under `VITE_`. Whether a stranger can call a mutating function. Whether you can halt the host tonight. If the public origin is already taking leads and you cannot name those five, stop. You do not need a new storyboard. You need this list.

Seal rows first. Then secrets. Then the origin. Bots do not wait for a nicer paywall. If a public payment path exists, prove it refuses the call when the stranger is logged out. Then strip leftover Canvas shares. Then halt once in a safe window so you know the off switch works. Then spend. This page is the week you run that list.

Treat those bars as calendar you reserve, not a vendor promise. If you cannot name the advertised origin, who can merge, and who can halt, the later days will thrash. The long bar is the expensive miss: a “small” test while a row or a chat secret is still the company.

Stay in Tempo, or leave. Do not mix the two jobs.

Pick one job for this week. Stay keeps Tempo as the studio, with sealed rows, secrets filled, a default-branch host as the origin, and a halt already proved. Leave opens the transition essay and stops buying clicks that need this merge window.

If you only need a leave date, use when to leave an AI builder. A door that will not close belongs on rewrite vs harden. A personal Git remote belongs on GitHub handoff. A host-only ship path belongs on CI/CD after an AI builder. Cousin wraps: Rork, Rocket.new. Those pages are not this Tempo week.

When the list turns red

Leave the product up. Kill the campaign if any of these are still true:

• A money or personal-data row is still readable logged out, or a stranger can read another user’s record.
• A live key still exists in chat, in client code, or under a `VITE_` name.
• Ads, mail, or Auth still list Canvas Play, localhost, or a leftover branch-live share you do not mean to keep.
• The only restore is “we will Discard,” and you have never cold-booted the repo with Tempo closed.
• The off switch is another Chat turn, or you have never halted the advertised host.
• Two people disagree about who can merge or who can enable Agents.

A single red door is a miss, even if Canvas Play is green. Stop adding storyboards until rows, secrets, the origin, and halt are honest. Finish those doors. Then spend — or open the transition essay if the studio is still the company.

Bring a second pair of hands when the founder cannot rotate a key without pasting it back into Chat, when a stranger can still read a row, or when nobody has halted the host before the date. Hire for owner rules, secrets, merge seats, and the origin map — not a prettier home screen. Austin app development company is the studio brief. Austin mobile app development if the next door is a store binary that still depends on this Tempo merge.

Next steps

Walk the gates in order. Inventory the public origin, the person who can merge, and who can enable Agents. Drain chat into the env panel or the host vault. Rotate anything that appeared there. Require an owner on money and personal-data rows. Prove a stranger test on the advertised host. Cold-boot the remote with Tempo closed. Halt once. Then buy the click — or open the exit if the process itself must leave Tempo.

CodeCross LLC is an Austin-registered product studio (1606 Headway Cir STE 9212, Austin, TX). The Tempo week we run is sealed rows, secrets filled, a default-branch origin you own, a repo you have already started, then a halt you have already hit. The Austin app development company page is the studio brief. Austin mobile app development is the store-binary door if strangers still hit this Tempo-shipped host. Company-level evidence lives on proof. When the off switch, secrets, or the advertised origin is still open, book a conversation.

Tempo is allowed to stay the studio. Ads are not allowed to treat a green Canvas Play, an open row, or an unreviewed chat secret as that proof. Show a halt you can hit, rows that refuse a stranger who is not the owner, and keys that never lived in chat. Most teams never need a second codebase once those three exist.

FAQ

Can Tempo’s Visual Review catch a row rule that lets the wrong customer see an order?

No. Visual Review pixel-diffs tracked storyboards against the default branch. A person approves a layout change. That is not Supabase RLS. Call the API as user B against user A’s record on the advertised host. If the row returns, spend stays off — even if every storyboard is approved.

Which origin may paid clicks open after a Canvas Play session looks finished?

The host that builds from the default branch, or the one custom domain you proved. Canvas Play is a live iframe of localhost. Changelog branch-live shares are reviewer doors. Google Search Central wants one preferred URL. Do not advertise a domain if clicks still open a share.

Who can enable a Slack-triggered Agent that opens pull requests on the branch ads already use?

A Member, unless you took the seat back. Agents are born disabled and act as you. Organizations let Members see and edit everything and invite others. Only an Admin can remove members. Name who may enable an Agent before you buy a click. An enabled Slack trigger is a door, not a courtesy.

Where does a Stripe secret belong when Canvas iframes share the Vite env with localhost?

In the host vault, never under `VITE_`. Vite bakes `VITE_` names into the client. Stripe says only a `pk_` key is safe to expose. Setup scripts can symlink `.env.local` from `$TEMPO_SOURCE_PATH` so the file never commits. Rotate anything that sat in Chat.

What still answers strangers after you quit the Tempo desktop app?

The advertised host. Agents do not run while Tempo is closed. That stops new pull requests. It does not take down the last deploy. Migrate moved ship off the old web editor. Closing the desktop app is not Unpublish. Name a host halt you have already hit.

Does the visual-review:bypass label replace a host halt you can hit tonight?

No. Visual Review says the bypass label posts success without capturing. Use it for incidents on the PR, not as a campaign off switch. Discard drops an unmerged worktree. It does not roll back a host that already built the merge. Halt the advertised origin once in a safe window so you know the control works.