Writing

Notes on Bubble.io, AI, and shipping things.

69 posts on Bubble.io, AI, n8n, and shipping production apps that hold up.

How I migrated a live app off Lovable onto my own Supabase and Vercel: the full runbook: cover image

Latest

· 40 min read · lovable , supabase , vercel

How I migrated a live app off Lovable onto my own Supabase and Vercel: the full runbook

Step-by-step runbook to move a live app from Lovable to your own Supabase and Vercel, with rollback gates, real incidents, and fixes.

Read as a series

Topical clusters meant to be read in order, or jumped into anywhere.

Supabase Production Hardening 8 posts
Read the series
Chrome Extension Lifecycle 3 posts
Read the series
Claude Code Engineering 9 posts
Read the series
Data Pipeline Reliability 4 posts
Read the series

Recent writing

View all 69 →

·7 min read · supabase , supabase-vault , postgres

How to encrypt API keys and client secrets in Supabase

Use Supabase Vault to encrypt API keys and client secrets, keep metadata in Postgres, and gate decrypts behind one checked SECURITY DEFINER function.

How to encrypt API keys and client secrets in Supabase: cover image

·6 min read · chrome-extension , github-actions , pre-commit-hooks

Chrome extension version-bump discipline: pre-commit + GitHub Actions

The Chrome Web Store rejects re-uploads with the same manifest version. Catch the missed bump locally in a pre-commit hook; gate it again in CI.

Chrome extension version-bump discipline: pre-commit + GitHub Actions: cover image

·7 min read · chrome-extension , manifest-v3 , supabase

How to build a Chrome extension popup with Supabase Auth (step by step)

Wire Supabase Auth into an MV3 popup: bundle the UMD, persist sessions in chrome.storage, recover state on reopen. Working code included.

How to build a Chrome extension popup with Supabase Auth (step by step): cover image

·10 min read · chrome-extension , manifest-v3 , chrome-web-store

Shipping a Manifest V3 Chrome extension: the gates nobody mentions

Trader verification, publisher identity, the URL slug gotcha, version-bump CI: the async gates that turn a one-day project into a three-week project.

Shipping a Manifest V3 Chrome extension: the gates nobody mentions: cover image

·8 min read · methodology , refactoring , lovable

Phased migrations with per-phase verification gates

Big-bang refactors of 6+ files break things you cannot predict. Phased migration with explicit gates catches regressions before they compound.

Phased migrations with per-phase verification gates: cover image

·8 min read · claude-code , claude-md , lovable

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow

Four files that fix the missing context in AI-built codebases: CLAUDE.md, ISSUES.md, a prompts/ folder, and a two-AI handoff workflow.

How I document AI-built projects: a CLAUDE.md, ISSUES.md, and prompts/ workflow: cover image

·7 min read · react-hook-form , zod , react

How to migrate a useState form to React Hook Form and Zod (the real walkthrough)

Step-by-step migration from useState to React Hook Form, Zod, and shadcn Form. Code diffs, validation mode choice, and four gotchas covered.

How to migrate a useState form to React Hook Form and Zod (the real walkthrough): cover image

·7 min read · supabase , supabase-auth , supabase-publishable-key

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.

Supabase publishable keys return 401 from hand-rolled fetch. Migration to @supabase/supabase-js with a chrome.storage.local session adapter.

Migrating to Supabase publishable keys broke my Chrome extension. Here is the fix.: cover image

·9 min read · lovable , lovable-security , supabase

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook

Audit a Lovable app after the BOLA disclosure: exposure checks, Supabase key rotation, Chrome extension SDK migration, and pre-revoke verification.

How to audit a Lovable app after the BOLA disclosure: a 6-hour rotation playbook: cover image

·7 min read · supabase , supabase-realtime , security

Realtime broadcast scope is a security boundary, not a routing convenience

Default-public Realtime broadcasts leak message bodies to every subscriber. The private-channel flag plus RLS is the fix.

Realtime broadcast scope is a security boundary, not a routing convenience: cover image
Browse all 69 posts in the archive

All topics