Knowledge base
Field notes on mobile, web, and the economics of shipping a product that earns its keep.
LatestBusiness
Own the registrar, lock and auto-renew the name, point A/CNAME records, wait for HTTPS, and publish MX, SPF, DKIM, and DMARC so mail is not spam.
Business
01 / 49
Company login, not a contractor
Apex and www, then the padlock
MX, SPF, DKIM, DMARC
Index
Business
Keep six restore copies on a live AI-built app: database, uploads, sign-in users, secrets list, code repo, and domain records.
Business
Once an AI-built app is live, watch six signals so you hear a break first: uptime, crashes, failed sign-ins, payment messages, slow pages, and one named owner.
Business
After you harden an AI-built app, run a named invite list at $0 paid spend. Prove auth, data, crash, support, and a kill switch before any ad tap.
Business
Before a hired developer starts, write who holds each login, who owns data and the domain, who pays the bills, and what is already broken.
Engineering
Secret keys typed into Tempo Canvas can show up in the browser for anyone who opens the page. The view on your laptop is a lab, not a place for ads. Name one live address that builds from your main branch. Make sure only the owner can see money records. Prove you can take that live address down after you quit the desktop app.
Engineering
Keys meant for the phone can ride on every Rork cloud preview a tester opens. That preview is not the store app. Pick one door you already tried — a TestFlight build, a Play test track, or the one public Rork site you share. Keep payment keys on the server. Name how you take the public site or the store listing down before you buy a click.
Engineering
Rocket.new can look finished on the practice launch while the live site still uses the wrong keys. Treat the practice launch as a lab. Point ads at the live custom domain or the one public Rocket host you mean to keep. Keep live payment keys out of chat. Require a real sign-in before anyone can change data. Taking the site down is the proof; undoing a chat step is not.
Engineering
Keys pasted into Create.xyz chat are already leaked. The secrets drawer is the only place they belong on the live host. The preview is only for review — never buy ads against it. Share the published Create address or the custom domain a stranger already opened. Export a copy of the data you control. Taking the site down is the off switch, not another prompt.
Engineering
A FlutterFlow test that looks green can still let any signed-in stranger read every other person’s records. Write rules that name the owner of each record. Keep payment secrets off the phone. Point ads at the store app or your own domain, never a leftover FlutterFlow test tab. Restore an older store version once so you know the off switch works.
Engineering
A key that sat in Cursor chat is a live key. Hiding a file from the agent does not hide it from the terminal. Move secrets into the live host's secret store. Have a person review every draft change. Buy ads only against a site you own. The halt is an older live version you can put back.
Engineering
Emergent’s preview database is not the live one, and a sleeping preview is not a place for ads. Put keys in the secrets drawer, not in chat. Require a real sign-in before anyone can write data. Point clicks at the published host or your domain. Name who can publish. Shut the preview down once so you know the off switch works.
Engineering
Base44 can leave write access open to anyone who has the link. Lock that door first. Put keys in the secrets drawer. Restrict tables that hold personal data or money to the creator or a named role. Prove a stranger cannot read another person’s record on the published URL. Then prove you can take the site down.
Engineering
You are about to send a customer a Lovable, Bolt, Bubble, Framer, Base44, Softgen, or v0 preview or default host. Here is what anyone else in the US can still open on that same link.
Engineering
a0.dev can send a store build while a secret still sits in the chat. Treat the web preview and the phone QR as a lab. Keep service files out of the project. Prove company store seats and host-held secrets on a real device build. A new chat keeps files. It does not undo a live update already on phones.
Engineering
A public Windsurf preview address is still a preview. Keep it off ads. Secrets in chat, rules, notes, or a secrets file saved in the project are live keys. Company git and host-held secrets are the next proof. A named checkpoint undoes local edits. It is not a way to roll back the live host. Ads wait until a stranger test holds.
Engineering
Hiding a Bubble page does not stop a stranger from reading the data. Privacy rules are the real gate. Put keys that talk to other services in the private settings, never in a shared list. Keep live and test data apart. Stop using leftover Bubble test addresses. Restore an older live save as the off switch. Search work still costs money while you rehearse.
Engineering
Custom code on a Framer site ships as public HTML, so a signing secret in the page is already gone. Store that signature off the page. Limit who can write to the content library. Turn form spam blocking on. Use an older published version as the halt. Connecting your own domain does not retire the leftover Framer preview.
Engineering
A payment key typed into a v0 thread should be treated as escaped. Put the replacement in project settings for the live host. Names that ship to the browser are not secrets. A sign-in that only works in the canvas is not a customer session. Name who can roll the live host back to an older live version. Anyone with the link can still open the chat after you ship.
Engineering
Softgen chat is not the secrets drawer, and a name that ships to the browser is not a safe. Log into your own host account and publish there when the campaign needs a project you can name. Turn accounts on before you promise them. Take secrets away from invitees. Run one export. The vendor already says production hosting is not included.
Engineering
A name that ships to the browser on a Lovable secret puts the value in the built files, so a service key there is already exposed. A sign-in that works on a week-long preview is not proof the public address or record rules hold. Keep the confirm-email step on. Turn off new sign-ups if bots will find the form. Restore once from backups. The leftover Lovable project address stays after you set a primary domain — do not advertise it.
Engineering
Replit secrets sitting in a shareable pane are already a leak. A warm reserved machine is not proof the door is closed. Put secrets in the right store. Prove login is a real session on the address people will type. Send errors somewhere a person can see. Keep the default Replit address off public links. Run a database restore you have actually clicked.
Engineering
A 2026 operator playbook for founders who prototyped in Lovable, Replit, Bolt, Cursor, v0, or Softgen: stand an org-Git pipeline that runs without the builder pane — protected main, checks on PR, a named host, smoke, and rollback.
Engineering
A 2026 timing playbook for founders who prototyped in Lovable, Replit, Bolt, Cursor, v0, or Softgen: red, yellow, and green signals for when to keep iterating, harden in place, or leave the builder without rewriting the MVP.
Engineering
Always On and a .replit.app preview are a lab. In 2026, CodeCross LLC frames the Replit exit as export, secrets off the pane, a host you can name, env plus CI, DNS cutover, smoke tests, and a kill date — without rewriting the screens users already accepted.
Engineering
After Lovable, Bolt, Rork, FlutterFlow, Cursor, v0, or Replit: prove a company GitHub org owns the remote, a second maintainer can merge, and CI rebuilds without a builder login. CodeCross LLC frames the 2026 Git ownership gates.
Engineering
After Lovable Cloud, Bolt, FlutterFlow, Rocket, or a0 leave you on Supabase: prove Auth subjects, RLS+grants, no client service_role, Storage policies, and a restore drill before ads. CodeCross LLC frames the 2026 evidence gates.
Engineering
A founder exit plan after an AI builder: freeze DNA, assign owners, sequence Git/secrets/restore weeks, then rehearse traffic or stores. CodeCross LLC frames the 2026 calendar.
Engineering
Rewrite vs harden after any AI builder: evidence gates, cost/risk, and a stay / harden / bound-rewrite sequence. CodeCross LLC frames the 2026 decision.
Engineering
Cursor prototype to App Store & Play: signing, compliance, owned backends, crash gates. CodeCross LLC sequences the 2026 store path.
Engineering
Bolt MVP hardening without a rewrite: keep product DNA, harden persistence, auth, and CI. CodeCross LLC sequences the 2026 harden path.
Engineering
A Rork preview is not a store binary.
Engineering
Most Lovable exits do not need a greenfield rewrite. Take ownership first (GitHub sync plus a backend you can operate), harden the trust boundary, migrate data with a rollback window, then cut over hosting — and keep Lovable Cloud until the new path is verified.
Engineering
A demo proves a path can work. Production-ready means that software can safely serve real users under expected failure, security, operational, and release conditions — with one ship gate: no release goes live until a tested rollback path exists.
Business
A Clutch screenshot is not a shortlist. Score Austin and remote partners on seats, proof, first-value honesty, and year-one keep-alive — then talk price.
Business
After the SOW is signed, kickoff week proves access, seats, and the first-value slice — not a slide deck. A 2026 operator calendar for Austin app builds.
Business
Your legal entity should hold Apple and Google publisher seats — not a freelancer laptop and not “the agency for now.” A 2026 ownership gate for Austin app builds.
Mobile
Flutter and native both ship. For Austin startups in 2026, pick by first-value speed, native-module tax, and who can maintain the stack — not by slogan.
Business
An Austin app SOW is readable when assumptions, seats, stores, and year-one keep-alive are explicit — not when the total looks cheap. A 2026 operator pass.
Business
A Notion dump is not a brief. Name first value, platforms, integrations with owners, store clocks, and out-of-scope — so discovery does not invent your product.
Business
A shipped binary is not finished. This is CodeCross’s own estimate, not a store rule: year-one keep-alive often runs about 15–25% of build cost.
Mobile
A PWA is not free native. Pick mobile, web, or PWA by load-bearing capabilities — install paths, push, offline, and store distribution — before you fund compilers.
Mobile
From September 30, 2026, unverified developers cannot take new installs from Play and participating stores on certified Android devices in the first-wave countries. Different clock from API 36.
Mobile
From Aug 31, 2026, new apps and updates must target API 36 except Wear OS/Automotive (35) and TV/XR (34). Idle apps lose discovery.
Mobile
A single Flutter or React Native codebase still ships two stores. In 2026 the cost flips when native modules, store-specific UX, or performance-sensitive UI dominate.
Mobile
Most rejections are process failures — crashes, incomplete demos, privacy mismatch, thin functionality — not mysteries. Fix gates before upload.
Business
Monetization is a product and architecture choice — subscriptions, IAP, ads, or sales-led — made early enough that auth, stores, and analytics match the money path.
Mobile
Simple apps often take a few months; medium builds mid-year; complex work can run toward a year. Auth, payments, stores, and decision latency usually matter more than the brochure range.
Business
Austin app cost is people time plus official store fees and local pay. This page cites Apple, Google Play, and BLS, then names what drives the bill.