afterbuild/ops
§ EX-10/vercel-deployment-expert
Vercel deployment expert for AI apps

Vercel deployment expert for AI apps — Vercel build fail fix, Vercel env var fix, Next.js deployment fix

By Hyder Shah11 min readLast updated 2026-04-15
Quick verdict

A Vercel deployment expert for AI apps fixes the three things that kill 85% of Lovable deploys. We run the Vercel env var fix (diff preview vs production, add Zod preflight), the Vercel build fail fix (tsc + eslint + test gate, Node version pin, output dir), and the Next.js deployment fix (ISR correctness, remotePatterns for images, OAuth redirects, webhook URLs) — fixed price, 48-hour audit, 7-day delivery on the full deploy-to-production pass.

Why AI builders ship broken Vercel deployment

Vercel is the default deploy target for every AI-built Next.js app. AI builders know this, and they generate code that works on Vercel in a single click — right up until you hit a real edge case. The preview URL gets auto-wired env vars, permissive caching, and auto-provisioned domains. Production doesn't. Every assumption in the generated code has to be re-validated on a real domain.

The three failure modes we see, in order of frequency. First, environment variables: the AI builder sets them on preview; you copy them to production and typo one, or forget the NEXT_PUBLIC_ prefix, or put a server secret in the client bundle. Second, edge function timeouts: AI-generated API routes do heavy work inline that exceeds Vercel's 10-second (Hobby) or 15-second (Pro) edge limit; the response never arrives. Third, caching and ISR/static mismatches: a page is statically rendered at build but depends on data that changes per user; it ships stale content or explodes when the user's session doesn't match.

The fourth bucket is smaller but critical: Supabase RLS disabled, OAuth redirects pointing at the preview URL, Stripe webhook endpoints pointing at the preview URL, and image optimization domains not configured. A Vercel deployment expert enumerates every integration, validates every environment, and builds a pre-flight checklist that refuses to deploy if any check fails.

Source: Vercel — Environment variables and edge function limits docs

§ MATRIX/ai-builder / failure-mode

Which AI builder shipped your broken Vercel deployment?

The Vercel deployment failure mode usually depends on the tool that shipped the code. Find your builder below, then read the matching problem page.

AI builderWhat breaks in Vercel deploymentGo to
LovablePreview env vars never copied to production. OAuth redirects hard-coded to lovable.app. Supabase RLS off.Lovable deploy fix
Bolt.newBuild config assumes Bolt's runtime. Edge function timeouts on inline Stripe calls. Static pages miss dynamic user data.Bolt.new deploy fix
v0v0 output deploys cleanly; the gap is missing backend. We add API routes and env var wiring.v0 to production
CursorRegression loop — fixes one env var, breaks the next deploy. Caching config drifts across prompts.Cursor deploy fix
Replit AgentCode assumes Replit's runtime (long-lived Node process). Vercel's serverless model breaks the cron and background workers.Replit to Vercel
Claude CodeWrites correct Vercel config when told. Silently assumes localhost env patterns when not.Claude Code architecture fix
WindsurfEnterprise CI/CD often bypasses Vercel. Migration to Vercel means rewriting the deploy pipeline.Windsurf deploy fix
Base44Base44 doesn't deploy to Vercel directly. Escape means a full port plus Vercel setup.Base44 backend fix
§ ANATOMY/vercel deployment / failure

Anatomy of a 'works in preview, broken in prod' deploy

A Lovable founder messaged us on launch day: 'the preview works perfectly, production is a white screen.' This is the single most-cited pain pattern in our user-needs research — quoted verbatim dozens of times across Reddit, Trustpilot, Medium, and support forums. 'It worked in the preview, broken in production.' 'Won't publish.' 'Won't deploy.' We've rescued more apps from this single failure mode than any other.

The root cause on launch day was a clean example of the top three causes, which combined explain about 85% of Lovable deploy failures. First: environment variables existed in Lovable's preview environment but had never been copied to Vercel production — specifically the Supabase URL, anon key, and a custom email API key. Second: Supabase RLS had been disabled during iteration and never re-enabled; the preview had permissive policies because the AI builder needed them for its own testing, and the production DB had never had explicit policies written. Third: Google OAuth's authorized redirect URIs were still set to the Lovable preview subdomain, so sign-in with Google returned redirect_uri_mismatch and the frontend crashed trying to parse the error response.

The fix was 4 hours on the emergency triage tier ($299).
Hyder Shah· Vercel deployment rescue engineer

The fix was 4 hours on the emergency triage tier ($299). We ran a scripted diff between preview and production env vars and shipped the missing 7 variables with proper NEXT_PUBLIC_ vs. server-only discipline. We wrote RLS policies for the 11 tables that needed them, tested them from anon and authed roles, and deployed. We added the production domain to Google OAuth's console and Supabase's redirect allowlist. We also installed a pre-flight check as a Vercel build step that refuses to deploy if any expected env var is missing or if a server secret has leaked into a NEXT_PUBLIC_ variable — a 50-line Zod validator that now guards every deploy.

Three months later the founder is on autopilot with the deploy pipeline. The pre-flight has caught two regressions since, both during AI builder re-iterations that tried to add env vars the wrong way. The $299 triage paid for itself before the launch week was over.

§ RESCUE/vercel deployment / engagement

What a Vercel deployment rescue engagement ships

From first diagnostic to production handoff — the explicit steps on every Vercel deployment engagement.

  1. 01

    Free rescue diagnostic

    Share the repo, the Vercel project URL, and the specific failure (build error, runtime error, or silent regression). In 24 hours we return a written fix plan with a fixed price.

  2. 02

    Deploy audit

    We enumerate every env var, every API route, every edge function, every image domain, every webhook URL. We diff preview against production and find the drift. Delivered as a written report.

  3. 03

    Deploy-to-production pass

    We fix env var propagation, migrate slow handlers off edge where needed, configure ISR correctly, wire OAuth and Stripe webhooks to the production URL, and add a pre-flight check that refuses broken deploys. $1,999, 7 days.

  4. 04

    Monitoring and rollback

    Sentry for errors, Vercel Analytics for Core Web Vitals, Axiom or Logtail for function logs, a documented rollback procedure tested against your staging environment.

  5. 05

    Handoff

    Delivery doc, Loom walkthrough of the deploy pipeline, runbook for common Vercel incidents (build failure, function timeout, env var change). Optional retainer for ongoing ops.

§ AUDIT/vercel deployment / first-pass

Every Vercel deployment rescue audit checks

The diagnostic pass on every Vercel deployment rescue. Each item takes under 10 minutes; together they cover the patterns that cause 90% of AI-built-app failures.

  1. 01
    Env var parity between environments

    We diff Vercel env vars across Development, Preview, and Production. Missing production entries and preview-only values are flagged.

  2. 02
    NEXT_PUBLIC_ prefix discipline

    Anything with NEXT_PUBLIC_ ships to every browser. We grep for service role keys, secret keys, and admin credentials in NEXT_PUBLIC_ variables.

  3. 03
    Function timeout limits

    Vercel Hobby: 10s. Pro: 15s by default, extendable to 60 or 300. Edge: 25s. We audit every API route for inline slow work that risks timing out.

  4. 04
    Image optimization remotePatterns

    next/image blocks unlisted remote hosts. We map every image source (Supabase, S3, Cloudinary, third-party CDNs) and update next.config.

  5. 05
    ISR and static rendering correctness

    Static pages with user-specific data are a bug. We identify and either move to dynamic rendering or add proper revalidation.

  6. 06
    OAuth redirect URIs in provider consoles

    Google, GitHub, Microsoft — every provider's allowlist must include the production URL exactly. Mismatches cause 400s.

  7. 07
    Stripe and webhook endpoints pointing at production

    Every webhook endpoint must be updated atomically at the cutover; leftover preview URLs drop events silently.

  8. 08
    Custom domain and SSL verification

    Apex and www variants configured, SSL cert issued, HSTS header set, redirects from non-canonical hosts.

  9. 09
    Build command and output directory

    Framework preset, Node version, build command, and output directory match what the AI-generated code expects.

  10. 10
    Monitoring wired up

    Sentry for errors, Vercel Analytics for Core Web Vitals, Axiom/Logtail for function logs. Unmonitored apps fail silently.

  11. 11
    Rollback discipline

    Every deploy promotable to production via 'Promote to Production'. Reversible migrations so rollback doesn't strand schema changes.

§ DIFF/vercel deployment / before-after

Common Vercel deployment patterns we fix

These are the shapes AI-generated code arrives in — and the shape we leave behind.

The missing production env var
✕ before · ai-shipped
tsx
01Supabase URL and anon key configured in preview, never copied to production. Production deploy builds but crashes at first page load.
The missing production env var
✓ after · afterbuild
tsx
01Zod-parsed env module at the top of the app. Deploy fails at build time if any required var is missing. Production and preview env vars managed with a documented diff.
The missing production env var
The server secret in NEXT_PUBLIC_
✕ before · ai-shipped
tsx
01`NEXT_PUBLIC_STRIPE_SECRET_KEY=sk_live_...` in .env. Key ships to every browser.
The server secret in NEXT_PUBLIC_
✓ after · afterbuild
tsx
01Server secret named without NEXT_PUBLIC_ prefix. Pre-flight check fails the build if any NEXT_PUBLIC_ variable matches known secret patterns.
The server secret in NEXT_PUBLIC_
The inline-slow-work edge function
✕ before · ai-shipped
tsx
01API route calls an LLM, waits 12 seconds, times out at Vercel's 10s Hobby limit. User sees 'something went wrong'.
The inline-slow-work edge function
✓ after · afterbuild
tsx
01Work enqueued to Inngest, Trigger.dev, or Vercel Cron. Route returns 202 immediately. Client polls or listens via Realtime/webhook.
The inline-slow-work edge function
The static page with user data
✕ before · ai-shipped
tsx
01`/dashboard` marked `export const dynamic = 'force-static'` serves the same HTML to every user. User A sees User B's name.
The static page with user data
✓ after · afterbuild
tsx
01`dynamic = 'force-dynamic'` or proper ISR with user-specific cache tags. Revalidation on mutation.
The static page with user data
The unlisted image host
✕ before · ai-shipped
tsx
01Supabase storage URL in `<Image src>` without adding to remotePatterns. Production returns 400 on every image.
The unlisted image host
✓ after · afterbuild
tsx
01next.config.js images.remotePatterns includes every external host. Wildcarded only where necessary; pinned to specific hostnames otherwise.
The unlisted image host
The stuck-on-preview webhook
✕ before · ai-shipped
tsx
01Stripe webhook endpoint points at the last preview deployment URL. After DNS cutover, every payment event drops silently.
The stuck-on-preview webhook
✓ after · afterbuild
tsx
01Stripe webhook URL set to the custom domain's /api/webhooks/stripe route. Signing secret rotated. Events replayed via Stripe CLI to verify.
The stuck-on-preview webhook
The silent build
✕ before · ai-shipped
tsx
01Build command doesn't run tsc or tests. Type errors and regressions ship.
The silent build
✓ after · afterbuild
tsx
01Build command runs tsc --noEmit, eslint, and the unit test suite. Failure fails the build.
The silent build
§ FLAGS/vercel deployment / red-signals

Vercel deployment red flags in AI-built code

If any of these are true in your repo, the rescue is probably worth more than the rewrite.

flag
signal
why it matters
Preview deploys work, production crashes on first page load
Missing env vars in production, or RLS disabled on tables the preview's service role bypassed.
'FUNCTION_INVOCATION_TIMEOUT' in Vercel logs
An API route exceeds the plan's function timeout. Slow inline work that should be queued.
next/image logs 'host is not configured'
remotePatterns missing the image source. Image renders blank or returns 400.
Users report getting each other's data
Static rendering of user-specific pages. The same HTML is served to every user.
OAuth login works in preview, returns redirect_uri_mismatch in production
Production URL not in the provider's authorized redirect URIs.
Stripe webhook events show as 'failed' in the Stripe dashboard
Endpoint pointing at preview, or signature verification failing due to mismatched secrets.
NEXT_PUBLIC_ appears on any variable containing 'secret', 'service_role', 'api_key'
Server-only credential shipping to every browser.
§ PRICING/vercel deployment / fixed-price

Fixed-price Vercel deployment engagements

No hourly meter. Scope agreed up front, written fix plan, delivered on date.

price
$0
turnaround
Free rescue diagnostic
scope
Written deploy audit and fix plan in 24 hours.
View scope
featured
price
$299
turnaround
Emergency triage
scope
Single specific deploy bug fixed in 48 hours with root-cause report.
View scope
price
$799
turnaround
Integration fix
scope
One integration wired correctly for production — OAuth, Stripe, webhook endpoint.
View scope
price
$1,999
turnaround
Deploy to production
scope
Env vars, CI/CD, SSL, monitoring, rollback. 7-day turnaround.
View scope
§ EXAMPLES/vercel deployment / real-scopes

What Vercel deployment rescues actually cost

Anonymized, representative scopes from recent Vercel deployment rescues. Every price is the one we actually quoted.

Small rescue
$299

A founder on launch day with a white screen in production. Env vars, OAuth, RLS are the usual suspects. We triage, fix in hours, ship pre-flight check.

Scope
Emergency triage: root-cause identification, three-point fix, pre-flight validator installed.
Duration
48 hours
Medium rescue
$1,999

A seed-stage team whose deploys randomly break features. No monitoring, no rollback discipline, ISR misconfigured.

Scope
Full deploy-to-production pass: env parity, monitoring (Sentry + Vercel Analytics), ISR correctness, rollback tested, pre-flight in CI.
Duration
7 days
Large rescue
$6,499

A growth-stage SaaS migrating off Replit Agent to Vercel. Cron jobs, background workers, and the database need to move cleanly.

Scope
Full infrastructure port: Neon + pooling, Inngest for background jobs, Vercel Cron for schedules, staged cutover, monitoring, 2 weeks of stabilization.
Duration
3-4 weeks
§ RUNBOOK/vercel deployment / references

Vercel deployment runbook and reference material

The documentation, CLIs, and specs we rely on for every Vercel deploymentengagement. We cite, we don't improvise.

§ LATERAL/vercel deployment / specialists

Related Vercel deployment specialists

§ LATERAL/vercel deployment / problems

Related Vercel deployment problems we rescue

§ FAQ/vercel deployment / founders-ask

Vercel deployment questions founders ask

FAQ
Why does my Lovable app need a Vercel env var fix after preview worked?
Three causes cover 85% of Lovable production breaks. One: the Vercel env var fix — variables exist in preview but weren't copied to production. Two: Supabase Row Level Security is disabled; the anon key worked in preview because the preview had permissive policies. Three: Google OAuth is still pointed at your Lovable preview URL, not your production domain. Check those three in that order — a Vercel deployment expert for AI apps handles this as a $299 emergency triage with a 48-hour turnaround.
Why is my Vercel function timing out — is this a Next.js deployment fix?
Yes, it's part of the Next.js deployment fix. Vercel's serverless function timeout is 10 seconds on Hobby plans and 15 seconds on Pro by default, extendable to 60 or 300 seconds with config. Edge functions time out at 25 seconds regardless. AI-generated code routinely makes slow external calls (LLM inference, Stripe operations, Supabase RPCs) inline in a single handler. Fix: move long work to a queued background job with Vercel Cron, Inngest, or Trigger.dev.
How much does a Vercel deployment expert for AI apps cost?
Emergency triage for a single Vercel build fail fix or Vercel env var fix is $299 with a 48-hour turnaround. A full Next.js deployment fix pass — env vars, CI/CD, SSL, monitoring, rollback plan — is $1,999 and ships in 7 days. A scale-to-10k-users pass including Vercel tuning, edge caching, and database pooling is $6,499. No hourly billing.
What env vars does the Vercel env var fix cover for an AI-built app?
At minimum the Vercel env var fix covers: Supabase URL and anon key (both NEXT_PUBLIC_), Supabase service role key (server-only, never NEXT_PUBLIC_), Stripe secret key, Stripe webhook signing secret, OAuth client ID/secret per provider, and third-party API keys (Resend, Sentry, PostHog). A Vercel deployment expert for AI apps installs a Zod pre-flight that refuses to deploy if any are missing or if a server secret leaked into a NEXT_PUBLIC_ variable.
Can I run a production AI app on Vercel's free tier after the Next.js deployment fix?
Up to the point of real users, yes. The Hobby tier limits you to 10-second function timeouts, 100 GB-hours of function execution, and 100 GB bandwidth. That covers most MVPs and pilot launches even after a Next.js deployment fix. Once you have paying customers or SLAs, Pro ($20/mo per user) is mandatory — longer timeouts, analytics, and team access. Enterprise is for compliance requirements.
Why does my Vercel build fail with Supabase images — is this a Vercel build fail fix?
Yes, it's a classic Vercel build fail fix target. next/image requires you to list allowed remote hosts in next.config.js under images.remotePatterns. AI builders often skip this for preview and it works because Vercel disables the check in dev. In production the check runs and any unlisted host returns a 400. The Vercel build fail fix: add your Supabase project's storage URL to remotePatterns and redeploy.
ISR vs static on Vercel — what does the Next.js deployment fix correct?
Static means the page is pre-rendered at build and served from cache forever until the next deploy. ISR (Incremental Static Regeneration) means the page is pre-rendered and revalidated on a schedule or on demand. AI builders often mark user-specific pages as static, which serves the same HTML to every user — the Next.js deployment fix migrates those to dynamic rendering (server-side) or ISR with proper revalidation tags.
How do I roll back a broken Vercel deploy — is rollback part of the Vercel deployment expert engagement?
Yes. Vercel keeps every deploy forever. Go to Deployments, find the last working deploy, click 'Promote to Production' — under 10 seconds. If the broken deploy also ran a database migration, rollback is harder; a Vercel deployment expert for AI apps always pairs reversible migrations with deploys so rollback stays open. That discipline is part of our $1,999 Next.js deployment fix pass.
Next step

Your AI builder shipped broken Vercel deployment. We ship the fix.

Send the repo. We'll tell you exactly what's wrong in your Vercel deployment layer — and the fixed price to ship it — in 48 hours.

Book free diagnostic →