FixesFixes for errors in real apps
One page per error message: what causes it and how to fix it, checked against the vendor’s own docs. If you’d rather hand it over, each page shows how.
Errors in web apps and back ends
- Stripe webhook errorNo signatures found matching the expected signature for payloadUsually it’s the wrong signing secret. Each endpoint has its own, the Stripe CLI prints a different one, and the same endpoint has a different secret for test and live keys. Next most likely: your framework parsed or changed the request body before the signature check ran.
- Stripe fulfillment bugThe payment went through in Stripe, but the account was never upgradedMost often, the upgrade only runs on the success page after checkout. Stripe says you can’t rely on that page, because customers don’t always reach it. Grant access from a webhook instead, and check the webhook’s delivery log in the Dashboard for failed deliveries.
- Firebase Firestore errorFirebaseError: Missing or insufficient permissionsUsually the query asks for more than the rules allow. Firestore rules are not filters: if a query could return even one document the user can’t read, the whole query fails. Add the same conditions to the query that the rule checks. Next most likely: no user is signed in yet when the request runs.
- Netlify and Vercel deploy error404 "Page not found" when you refresh a page or open a linkYour app is a single-page app: one index.html that handles every route in the browser. When you refresh /dashboard, the host looks for a file at that path, finds none and returns 404. Add a rewrite that serves index.html for every path: a _redirects file on Netlify, or a vercel.json rewrite on Vercel.
- Netlify and Vercel build errorThe app works in Bolt or Lovable, but the deploy build failsScroll up the build log to the first error, not the last line. Most often it’s a missing environment variable: Vite builds VITE_ variables into the code at build time, and Netlify doesn’t read .env files, so they must be set in the host’s settings. Next: a different Node version, a file name whose capital letters don’t match the import, or warnings treated as errors.
- Supabase Auth email bugSupabase confirmation and reset emails link to localhost:3000Change the Site URL in Supabase under Authentication, URL Configuration, from http://localhost:3000 to your live address. Supabase uses it when your code doesn’t pass a redirect URL. If your code does pass one, that exact URL must also be on the Redirect URLs allow list.
- Replit deployment bugUploaded files or saved data disappear after you redeploy your Replit appReplit says to avoid saving and relying on data written to a published app’s file system. A publish is a snapshot of your project’s files, so treat anything the running app writes as temporary, not as part of the next publish. Keep records in a database, such as Replit’s managed PostgreSQL, and uploaded files in object storage, such as Replit’s App Storage.
- Supabase Edge Functions errorSupabase Edge Function call blocked by CORS policyThe function has to answer the browser’s OPTIONS preflight request and include CORS headers on every response, errors included. Supabase’s wrapper does this for you, or you can import corsHeaders from supabase-js. If it still fails, read the response status: an error can make the browser report CORS when the real problem is something else.
App Store rejections
- App Store rejectionGuideline 2.1 - Performance - App CompletenessTwo common causes of 2.1 rejections are a reviewer who couldn’t sign in and a build that crashed on their device. Add a demo account that works to the review notes, keep your back end running during review, and test the exact build on a real device before you resubmit.
- App Store rejectionGuideline 4.3(a) - Design - SpamA 4.3 rejection means Apple sees your app as a copy: several near-identical apps under different Bundle IDs (4.3(a)), or an app indistinguishable from what’s already widely available (4.3(b)). The fix is usually a product change, such as merging the copies into one app, or making the app meaningfully different, not a code fix.
- App Store rejectionGuideline 5.1.1 - Legal - Privacy - Data Collection and StorageThe most common 5.1.1 rejections: no way to delete an account inside the app (5.1.1(v)), purpose strings that don’t explain why the app needs a permission (5.1.1(ii)), a missing privacy policy link (5.1.1(i)), or a permission demanded before the user can do something unrelated (5.1.1(iv)). Each is a fixable change in the app or its listing.
A different error?
Describe it and get a written quote
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.