Getting it live
All 5 →It works on your computer, or it used to. Getting it online is where it stopped.
How do I get my app live?
Hosting that fits how the app is built, its settings, a database, your domain and HTTPS. The order to do it in, and where projects usually get stuck.
My app works on my computer but not online. Why?
The server isn't your computer. One of five things differs: settings, addresses, the database, the port, or file names. Here's how to find which.
My deploy keeps failing. What do I do?
The build log names it. Usually a different Node version, a lockfile out of sync, a missing setting, or a warning the host treats as an error.
My site is a blank white page after deploying. Why?
The page loaded but the app inside it didn't start. Usually its files are fetched from the wrong path, a setting was blank at build, or routing isn't set up.
How do I get my app onto the App Store and Google Play?
Developer accounts in your name, a build that doesn't crash, a live backend, a privacy policy, and, for new Google Play accounts, 12 testers for 14 days first.
Live but broken
All 8 →It's online, but visitors see an error, a blank page, or nothing at all.
My website is down. How do I fix it?
Find which layer failed first: the domain, the hosting account, the server, or the app. What the browser shows tells you where to start. A checklist, in order.
My website says "Not secure". How do I fix it?
The browser can't confirm a private (HTTPS) connection: no certificate, an expired one, one that doesn't cover this address, or insecure content on the page.
500 Internal Server Error after deploying. What does it mean?
Your server code hit an error it didn't handle. The page won't say what; the server logs will. After a deploy it's usually a missing setting, database or file.
502 Bad Gateway: what does it mean, and how do I fix it?
The server in front of your app asked your app for the page and got no proper answer. Usually the app has crashed, never started, or is on the wrong port.
503 Service Unavailable on my site. What's wrong?
The server is reachable but refusing work: it's overloaded, in maintenance, or has no running copy of your app to hand requests to. How to tell which.
My app can't talk to its own backend (CORS error). How do I fix it?
The browser blocked your frontend from reading your backend's reply, because the backend didn't list your site as allowed. The fix goes on the server.
Heroku says "Application Error". How do I fix it?
Heroku's generic page for an app that crashed, didn't start in time, or has nothing running. The code in heroku logs (H10, R10, H14, R14) says which.
My app crashes as soon as it opens. Why?
The crash report names the line. Usually the release build lacks something the test build had: a setting or key, code stripped to save space, or a live backend.
Your developer is gone
All 5 →The person who built it left. What you own, what you need, and what to do next.
My developer disappeared mid-project. What now?
Secure what you can reach today: code, domain, hosting, app store and payment accounts. Then check what you own, and what state the project is really in.
Who owns the code my developer wrote? (Australia)
In Australia, whoever writes code owns its copyright, unless they're your employee or assigned it to you in writing. Paying for it isn't enough on its own.
What should my developer hand over?
The code with its history, owner control of every account, every setting and secret, and notes on how to run, deploy and fix it. A checklist for before they go.
I've taken over code nobody understands. Where do I start?
Get it running exactly as it is before changing anything, map what it does, and protect what matters with tests. A rewrite is rarely the right first move.
My technical co-founder left. What happens to the product?
Two problems: the company's (equity, and whether the code was assigned to it) and the product's (who can run and fix it now). Secure access to both today.
Is it safe?
All 12 →Logins, user data, keys and databases: the holes that matter before real users arrive.
How do I check my app is secure before launch?
Check what attackers try first: who can see whose data, logins, open keys and databases, injection, payments, rate limits, HTTPS and old dependencies.
My website has been hacked. What do I do?
Take it offline, change every password, find how they got in, restore a clean backup, update, and ask Google to review. Then check if customer data was taken.
I leaked an API key. What do I do?
Revoke it and create a new one now, before anything else. Deleting it from the code doesn't help: it's still in the history. Then check what it was used for.
Do I have to report a data breach? (Australia)
If the Privacy Act covers you and the breach is likely to cause serious harm, yes: tell the OAIC and those affected. Suspected breaches: assess within 30 days.
My database is open to the internet. How do I close it?
Turn off public access, let only your app's servers through the firewall, and require a strong login. Then check the logs: it may already have been copied.
Supabase RLS is disabled. Is my data public?
A table in an exposed schema without Row Level Security is readable and writable through your public key, which is in your app. Turn RLS on for every table.
Is my Firebase database open to anyone?
If it was set up in test mode and never locked down, possibly. The API key being public is normal: the security rules are what protect the data. How to check.
Are my app's uploaded files public? (S3)
New S3 buckets are private by default, but a policy can open them. Turn on Block Public Access, and serve private files through short-lived signed links.
Are my environment variables public?
Anything your frontend can read, every visitor can read. Settings prefixed VITE_ or NEXT_PUBLIC_ end up in the browser. Secrets belong on the server.
Is it safe to keep login tokens (JWTs) in localStorage?
It's a risk: any script on your page can read localStorage, so one injected script can steal every logged-in session. HttpOnly cookies can't be read by scripts.
My project shows dozens of security warnings (npm audit). Should I worry?
Some, not all. npm audit lists known holes in the packages you use; many are in build tools that never reach users. Fix what ships, and test before forcing.
How much does a penetration test cost in Australia?
Australian testing firms publish indicative prices from a few thousand dollars for a small web app to tens of thousands for bigger scopes. What sets the price.
Built with AI
All 5 →An AI tool got it most of the way. Getting it the rest of the way, safely.
Is my AI-built app secure?
Don't assume so. Research found people using AI assistants wrote less secure code and were more confident in it. Check access control, keys and data first.
How do I get my AI-built app live (Lovable, Bolt, Base44, AI Studio)?
Use the builder's publish button to go live fast, or export the code to GitHub and host it yourself for control. What changes when you leave the builder.
The AI wrote my app and now it doesn't work. What do I do?
Stop asking it to fix everything at once. Go back to the last version that worked, find the first real error, and change one thing at a time, checking each.
How do I deploy my Replit app?
Use Replit's Publish button and pick a deployment type, or export the code and host it elsewhere. Settings stored as Replit Secrets have to move with it.
Who owns code written by AI? (Australia)
AI tools generally assign you whatever rights they have. But in Australia copyright needs a human author, so purely AI-generated code may not be protected.
It used to work
All 11 →Nothing changed, but now it won't install, build or start. Software rots when it sits.
Everything in my project is years out of date. How do I update it?
Get it running exactly as it is first. Then update in small steps (runtime, then framework, then the rest), testing between each, and replace what's abandoned.
npm install fails on my old project. How do I fix it?
Usually Node is too new for the project, the lockfile and package.json disagree, or a package needs build tools or no longer exists. Check each, in this order.
My project only runs on an old version of Node. What do I do?
Run it on its old version with a version manager so it works again, then upgrade one long-term-support release at a time. Node 20 and older are end of life.
Create React App is deprecated. What now?
Your app still works: Create React App is in maintenance mode but has no active maintainers. React recommends moving to a framework or a build tool like Vite.
npm ERESOLVE: unable to resolve dependency tree. What does it mean?
Two packages want different versions of a shared one, often React. --legacy-peer-deps forces the install but hides the conflict. Update the odd one out instead.
My site needs a newer PHP version. How do I upgrade safely?
PHP versions get four years of support, then none. Check what your code and plugins support, test on a copy, step up one version at a time, then switch live.
How do I upgrade an old Laravel app?
One major version at a time, following each official upgrade guide, upgrading PHP as you go. Laravel versions get security fixes for two years after release.
My Python project won't install its dependencies. How do I fix it?
Use a fresh virtual environment, the Python version the project was built for, and its pinned requirements. Most errors on old projects are version mismatches.
My Docker build fails. How do I fix it?
Find the Dockerfile step that failed. Old projects usually fail on an outdated base image, a file outside the build context, or installing dependencies.
My Docker container won't start. Why?
The container's logs say why. Usually the app crashed on start: a missing setting, a database it can't reach, the wrong command, or listening on localhost.
A database migration failed in production. What now?
Stop deploying, back up, and find out exactly which steps ran. Then either roll back and fix, or finish the steps by hand and mark it resolved. Never reset.
Save it or start over
All 4 →Whether the project is worth saving, and what that costs.
How do I tell if my code can be saved?
Ask four questions: does it run, does it do what users need, can someone follow it, and is its technology alive? Messy isn't the same as unsalvageable.
Should I rewrite my app from scratch or fix it?
Usually fix it. Rewrites take longer than planned, discard years of bug fixes, and leave nothing live meanwhile. Replace parts gradually when you must.
How much does it cost to fix or finish an app?
It depends on what's broken and missing, so get it assessed before anyone quotes. Preventionlabs: free assessment, then $10,000 AUD flat to get it live.
My startup failed. Now what?
Separate the business from the product. Work out why it stalled; if the product never got live, that may be the fixable part. If you close, close properly.
Locked out
All 6 →The domain, the hosting, the app store account: someone else holds the keys, or nobody does.
My domain expired. Can I get it back?
Usually, if you act fast. Expired domains can be renewed during a grace period: 30 days for .au names. After that they're deleted and anyone can register them.
My developer registered my domain. How do I get it back?
Whoever is listed as the registrant controls it, and for .au names the transfer password only goes to their email. Ask them to transfer it, in writing.
My app is on my developer's App Store account. How do I move it?
Both stores let the current holder transfer an app to your account, keeping reviews and users. They have to start it, and you need your own account first.
My app was removed from the App Store. Why, and can I get it back?
Stores remove apps that crash, break the rules, or go years without updates. Update it to current requirements and resubmit; Apple sets no time limit.
I'm locked out of my AWS account. How do I get back in?
Reset the root password from the sign-in page, or recover using the account's email and phone. If those are your old developer's, contact AWS Support.
My Heroku app stopped when the free tier ended. What now?
Heroku shut down free dynos and free databases from 28 November 2022. Either move to a paid Heroku plan, or move the app and its data to other hosting.
Won't cope with users
All 3 →It works for a handful of people. What happens when more arrive.
How do I make my app scale?
Make the app stateless so you can run more copies, keep data in managed services, and put capacity behind settings. Then scaling is configuration.
My website is slow. How do I speed it up?
Measure first: is the server slow to answer, or the page heavy to load? Then fix the biggest cause: images, JavaScript, slow queries or a small server.
My database is slowing everything down. What do I do?
Find the slowest queries and read their query plans. Missing indexes and one query per row of a list are the usual causes. A bigger database comes last.
Getting help
All 2 →When it's time to hand the project to someone who will get it live.
Software project rescue: what is it, and what should it cost?
Someone new takes over a stalled, broken or abandoned project and gets it working. What a good rescue includes, and how Preventionlabs prices it: $10,000 flat.
I need someone to fix my website. Where do I start?
Work out what kind of broken first: offline, insecure, erroring, slow or just dated. Each needs different help. What to send so you get a real answer.
Nothing matches that yet. Try fewer words, or tell us what's wrong and we'll tell you for free.
Can't find yours?
Tell us what you built and what's stopping it. We'll go through it and tell you in writing what's broken, what it takes, and whether it can be saved. Free.
Submit your project