ls ~/writing --sort=recent

[01]Writing

Notes on Bubble.io, AI, and shipping things.

lovable-to-vercel-supabase-migration · cover
A routine Supabase branch merge deleted the entire dev environment, permanently.

Latest

40 min [lovable][supabase][vercel]

How I migrated a live app off Lovable onto my own Supabase and Vercel: the full runbook

Step-by-step runbook to move a live app from Lovable to your own Supabase and Vercel, with rollback gates, real incidents, and fixes.

[02]Read in clusters

Supabase Production Hardening 8 posts Read the series Chrome Extension Lifecycle 3 posts Read the series Claude Code Engineering 9 posts Read the series Data Pipeline Reliability 4 posts Read the series Bubble.io 29 posts Browse the topic Automation & n8n 6 posts Browse the topic

[03]Recent writing

What breaks in production, written down.

view all 69

7 min [supabase][supabase-vault][postgres]

How to encrypt API keys and client secrets in Supabase

Store client secrets in Supabase Vault, keep searchable metadata in Postgres, and gate every decrypt behind one checked SECURITY DEFINER function. Step-by-step SQL with the gotchas.

supabase-vault-encrypt-client-secrets--cover
A leaked backup or one overbroad rule, and your clients’ passwords are plain text.

6 min [chrome-extension][github-actions][pre-commit-hooks]

Chrome extension version-bump discipline: pre-commit + GitHub Actions

The Chrome Web Store rejects re-uploads with the same manifest version. Catch the missed bump locally in a pre-commit hook; gate it again in CI.

chrome-extension-version-bump-precommit-ci--cover
Forget to bump one number and your users never get the update.

7 min [chrome-extension][manifest-v3][supabase]

How to build a Chrome extension popup with Supabase Auth (step by step)

Wire Supabase Auth into an MV3 popup: bundle the UMD, persist sessions in chrome.storage, recover state on reopen. Working code included.

chrome-extension-popup-supabase-auth--cover
Every time the Chrome popup closes, your user is logged out again.

10 min [chrome-extension][manifest-v3][chrome-web-store]

Shipping a Manifest V3 Chrome extension: the gates nobody mentions

Trader verification, publisher identity, the URL slug gotcha, version-bump CI: the async gates that turn a one-day project into a three-week project.

ship-manifest-v3-chrome-extension-web-store--cover
The code was finished in a day. Shipping it took six weeks.

8 min [methodology][refactoring][lovable]

Phased migrations with per-phase verification gates

Big-bang refactors of 6+ files break things you cannot predict. Phased migration with explicit gates catches regressions before they compound.

phased-migrations-verification-gates--cover
One day writing the migration, then three days fixing it while users hit the bugs.

8 min [claude-code][claude-md][lovable]

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow

Four files that fix the missing context in AI-built codebases: CLAUDE.md, ISSUES.md, a prompts/ folder, and a two-AI handoff workflow.

ai-built-project-4-part-system--cover
The only person who can explain your codebase is a model that forgot it six weeks ago.

7 min [react-hook-form][zod][react]

How to migrate a useState form to React Hook Form and Zod (the real walkthrough)

Step-by-step migration from useState to React Hook Form, Zod, and shadcn Form. Code diffs, validation mode choice, and four gotchas covered.

migrate-usestate-form-react-hook-form-zod--cover
The user only finds out what they got wrong after they have committed to saving.

7 min [supabase][supabase-auth][supabase-publishable-key]

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.

sb_publishable_* keys return 401 from hand-rolled fetch. Migration to @supabase/supabase-js plus a chrome.storage.local session adapter for Manifest V3. 158 lines of HTTP became 67.

supabase-publishable-keys-chrome-extension-auth-fix--cover
They sign in, close the popup, and thirty seconds later they are logged out again.

9 min [lovable][lovable-security][supabase]

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook

Audit a Lovable app after the BOLA disclosure: exposure checks, Supabase key rotation, Chrome extension SDK migration, and pre-revoke verification.

lovable-bola-disclosure-6-hour-rotation--cover
Five API calls from a free Lovable account read your database credentials and your API keys.

7 min [supabase][supabase-realtime][security]

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

supabase-realtime-broadcast-security-boundary--cover
Anyone who opens DevTools can subscribe to your Supabase channel and read every message.

Browse all 69 posts in the archive