Move the code to your own GitHub repository, read the code map, move every secret into environment variables, give the live app its own database with row-level security, add tests for the rules that must never break, deploy on Cloudflare Pages or Vercel, then add your domain, email, bot protection and alerts. Costs nothing on free plans apart from an optional domain.
Tools you need
The 11 steps
Get the code into your own GitHub repository
In your builder, connect GitHub and push the project to a private repository. Clone it to your computer:
git clone https://github.com/YOUR-NAME/YOUR-APP.git
cd YOUR-APPFrom now on the repository, not the builder, is the source of truth.
Run it locally
Most builders generate a Node project. Run:
npm install
npm run devOpen the local address. If it fails, copy the error into your coding assistant and ask what is missing; the usual cause is a missing environment variable.
Make a map of the code
Ask your assistant: list every folder and what it does; list every place that reads an environment variable; list every call to an external service. Paste the answer into docs/code-map.md. You cannot protect code you cannot describe.
Move secrets into environment variables
Search the repository for keys, tokens and passwords. Keep them in .env.local and add it to .gitignore. Only values meant to be public, such as a publishable database key, may use the VITE_ or NEXT_PUBLIC_ prefix, because those are sent to every visitor's browser. Anything that was ever committed or pasted into a public project must be rotated.
Give the live app its own database
Create a second Supabase project for production and keep the first for testing, so an experiment can never touch real data. Recreate the tables, then turn on row-level security for every table and add per-user policies. Take a backup with pg_dump before launch; free Supabase projects have no automatic backups and pause after a week of low activity.
Add tests for the rules that must never break
Install a test runner and write three tests: a signed-out visitor cannot read private data, user A cannot read user B's data, and bad input is rejected.
npm install -D vitest
npx vitest runAsk the assistant to draft the tests, then break a rule on purpose and confirm a test fails.
Deploy on a free host
On Cloudflare Pages, create a project from your repository, set the build command to npm run build and the output directory to dist (Vite) and add the production environment variables. Cloudflare's free plan allows 500 builds a month. Vercel Hobby also works, but it is for non-commercial use only: if the app takes payments or shows ads, use Cloudflare.
Add your domain and HTTPS
Add your own domain in the host's settings and create the DNS records it shows. Students can claim a free .me or .tech domain for a year through the GitHub Student Developer Pack. Check that the HTTPS padlock appears.
Set up email that reaches real users
Supabase's default sign-up email is limited to a few messages an hour. Verify your domain in Resend, then add its SMTP details in your database provider's auth settings. Resend's free plan allows 3,000 emails a month and 100 a day.
Add bot protection and alerts
Put Cloudflare Turnstile on the sign-up and contact forms and verify its token on your server. Add an UptimeRobot monitor for your address, and Sentry so crashes email you. Both are free.
Launch, then keep a way back
Tag the release in Git (git tag v1.0). If a deploy breaks something, redeploy the previous commit from your host's deployments page. Write the steps in your README so you can do it in a hurry.
Make it yours
- Add a staging site on a second branch so changes are tested before they reach real users.
- Add a GitHub Action that runs your tests on every push.
- Add PostHog to see which features people actually use.
- Move the front end to Cloudflare and keep the data on Supabase.
Troubleshooting
| Problem | Fix |
|---|---|
| The build fails on the host but works locally | Check the Node version in the host's settings and that every environment variable from .env.local exists on the host. |
| Blank page after deploy | The output directory is wrong. Vite builds to dist; Next.js on Vercel needs no output setting. |
| Sign-in links point to localhost | Add your live address as the Site URL and redirect URL in your auth provider's settings. |
| A key was visible in the browser | Treat it as leaked: rotate it, remove it from the code and Git history, and keep it server-side from now on. |
| The app stopped after a week of no visits | A free database project paused for low activity. Restore it from the provider's dashboard, and consider a paid plan before real users depend on it. |
Frequently asked questions
Can I run a Lovable or Bolt app outside the builder?
Yes. Both sync to GitHub, so you can clone the code and run it with Node. Backend settings such as database rules and secrets must be recreated or carried over carefully.
Is Vercel free for a project that earns money?
No. Vercel's Hobby plan is for personal, non-commercial use. Use Cloudflare Pages or a paid plan for anything that takes payments or shows ads.
Do I need a separate production database?
It is the safest habit. A test project lets you experiment freely, and the production project holds only real data that nothing experimental can touch.
What should I check before sharing the link?
Run the security checklist: row-level security, no secrets in the browser, bot protection and a backup.
Learn this with mentors
Programmes for builders and engineers with admissions open: live classes, mentors and project work.
