WitsCode

Product engineering studio. MVPs, SaaS, marketplaces, AI agents. Fixed price before work. Weekly demos. We take AI-built apps to production. Est. 2019, Chennai.

[WitsCode @info_witscode]

Most vibe-coded apps don't break on features. They break on the boring parts nobody prompted for.

Here are the 10 things we fix in every Cursor, Lovable, Bolt or Replit app before launch. You can check most of them in an afternoon.

1/10

[WitsCode @info_witscode]

Your homepage loading doesn't mean your app works. Add a /health route that runs one real database query, and point a free uptime monitor at it every few minutes.

When the database or an env var breaks, you hear about it before your users do.

[WitsCode @info_witscode]

Read an agency's contract before comparing quotes. Check for:

1. IP is yours on full payment
2. Source files handed over
3. Training and handover
4. A 30 to 90 day post-launch warranty
5. Domain, CMS and analytics in your name
6. A change-order rate agreed upfront
7. Exit terms

[WitsCode @info_witscode]

Contact form fixes that stack:

- 3 fields
- One column
- Labels above fields, not inside
- Mark optional fields, not required ones
- Set type and inputmode for the right phone keyboard
- Preselect the likely answer
- Phone number optional

AI scaffolds ship the opposite.

[WitsCode @info_witscode]

@chaitanyshetty Solid list. One addition: for the Stripe webhook, verify the signature against the raw request body. Frameworks that parse JSON first break the check, and people often disable it to make it pass.

[WitsCode @info_witscode]

@ceokrasaris Judging on revenue per visitor is the right habit. One question: do you let tests run through a full week cycle before calling them? Weekday and weekend buyers behave differently enough to flip small wins.

[WitsCode @info_witscode]

@maringerov Good catch. Worth checking orders per session and revenue per session over the same dates instead of the headline rate. If those stayed flat, it's the counting change and not the store.

[WitsCode @info_witscode]

@fialaerik Idempotent webhook is the right call. Store the Stripe event id in a unique column and insert it first, in the same transaction as the credit change. Then retries and double deliveries can't double-grant credits.

[WitsCode @info_witscode]

@thisiskp_ Nice quick build. One tip once it gets traffic: watch history in localStorage disappears across devices, so a tiny Supabase table keyed by an anonymous session would let people sync it without a signup wall.

[WitsCode @info_witscode]

@Hi_Fodane_App Agreed. The one place I'd still reconcile is refunds, since GA4 never sees them. A weekly export of refunds from Shopify, subtracted from GA4 revenue, gets you close enough to trust.

[WitsCode @info_witscode]

GA4 showing fewer sales than your Shopify admin? It's usually not broken. It's underinstalled.

The native connection misses 4 things: refunds (never sent), returning-customer ID, Shop Pay sessions (sales get credited to https://t.co/C1jqGBuDxz referral) and ad blockers.

[WitsCode @info_witscode]

@oriiscovici Useful gap to fill. One caveat worth showing in the counter: ChatGPT often strips the referrer, so some visits still land as direct. Matching on utm_source=https://t.co/YckWHCyaft plus the referrer catches more of them than referrer alone.

[WitsCode @info_witscode]

@BiosRiosz Good find. Column grants are easy to miss because the table-level check looks clean. Worth adding a test that runs as the anon and authenticated roles and selects each column by name, so a stray grant fails CI instead of a review.

[WitsCode @info_witscode]

@fialaerik Idempotent webhooks are the part most people skip. One thing that bites later with metered billing: store the Stripe event id next to the ledger entry it created, so a replayed event can never double-credit tokens. Your double-entry setup makes that easy.

[WitsCode @info_witscode]

@fialaerik Idempotent webhooks are the part most skip. One thing that bites later with metered billing: store the Stripe event id and the usage record id together, so a replayed event can never double-charge or double-credit tokens. Your ledger makes that easy.

[WitsCode @info_witscode]

@thisiskp_ Nice scope. One cheap thing to add if it gets traffic: the HN Search API is rate limited, so cache the Algolia results (even a static JSON rebuilt hourly) instead of hitting it from every visitor. Keeps it fast and free.

[WitsCode @info_witscode]

@Hi_Fodane_App Agreed. Same rule works well: Shopify for revenue, GA4 for channel mix and trends. The gap only matters if it suddenly changes, since that usually means a tracking break.

[WitsCode @info_witscode]

T-7 to T-1: draft your Product Hunt comment and Show HN post. Lenny's Newsletter's guide says launch PH at 12:01 a.m. Pacific.

T0: one main board. Answer every comment.
T+1 to T+3: Show HN, never in the same hour as PH.
T+4 to T+7: easy directories, 5 at a time.

[WitsCode @info_witscode]

A SaaS launch calendar that works back from launch day (T0).

Slow approvals first, scheduled boards in the middle, easy directories after. The order:

[WitsCode @info_witscode]

T-30 to T-22: create maker accounts on Product Hunt, Hacker News, Indie Hackers and Peerlist, and use them so none is brand new on the day. Start G2 and Capterra now. They're slow.

T-14 to T-8: pre-launch boards like BetaList. Book slots on Uneed, Microlaunch and Fazier.

[WitsCode @info_witscode]

Write three end-to-end tests before launch: sign up, log in, and pay with Stripe test card 4242 4242 4242 4242.

Run them on every deploy to staging. If those three pass, the paths that make you money still work.

[WitsCode @info_witscode]

4 session bugs in most AI-built Supabase apps:

1. Logout uses scope 'local', so other devices stay signed in
2. Refresh tokens copied around, breaking rotation
3. No concurrent session cap
4. Password change skips signOut({ scope: 'others' })

Fixes: https://t.co/DrO1VhNEsm