# Stacks PatchAndShip supports

Last updated: 2026-10-14

PatchAndShip supports web apps built with Lovable, Bolt, Replit or Cursor that use Supabase. Node and Express backends on Replit or Cursor are supported for the server-side items on our checklist; these are fixed, but they are not “critical” for the 48-hour guarantee.

## App builders

- Lovable
- Bolt
- Replit
- Cursor

## Backend

- Supabase: Row Level Security, storage, keys, env vars and auth URLs (checklist items 1 to 8).
- Node/Express backends on Replit or Cursor are supported for the server-side items on our checklist (items 9 to 13; fixed, but not “critical” for the 48-hour guarantee).

## Deploy targets (Fix & Deploy only)

The Fix & Deploy package ($249) deploys one app to Vercel or Netlify, or keeps a Lovable or Replit app on that platform's own hosting with your domain. Each order covers one app, one Supabase project (or one Node app) and one deploy target.

- For Lovable apps, Fix & Deploy deploys to Vercel, Netlify or Lovable's own hosting.
- For Bolt apps, Fix & Deploy deploys to Vercel or Netlify. We don't deploy to Bolt's own hosting.
- **Cursor and other code-based apps:** Fix & Deploy deploys to Vercel or Netlify.

Builder and deploy target (Fix & Deploy)

| Builder | Vercel | Netlify | Lovable hosting | Replit hosting |
|---|---|---|---|---|
| Lovable | Yes | Yes | Yes | Not applicable |
| Bolt | Yes | Yes | Not applicable | Not applicable |
| Replit | Not offered | Not offered | Not applicable | Yes |
| Cursor | Yes | Yes | Not applicable | Not applicable |

Replit apps with a Node/Express server are deployed on Replit hosting.

## Platform notes

- “Supabase is deprecating the `anon` and `service_role` keys by the end of 2026”, in favor of `sb_publishable_` and `sb_secret_` keys. ([Supabase Docs: API keys](https://supabase.com/docs/guides/api/api-keys))
- Vite docs: “Variables prefixed with `VITE_` will be exposed in client-side source code after Vite bundling.” And: “`VITE_*` variables should not contain sensitive information such as API keys.” ([Vite Docs: Env Variables and Modes](https://vite.dev/guide/env-and-mode))
- Vercel: in a Vite single-page app, “deep linking won't work out of the box”. You need a catch-all rewrite to `/index.html` in `vercel.json`. ([Vercel Docs: Vite on Vercel](https://vercel.com/docs/frameworks/frontend/vite))
- Replit: a published web server “must listen on `0.0.0.0`”. Listening only on `localhost` or `127.0.0.1` “does not work for published apps”. Secrets set in the editor “do not automatically carry over to your published app.” ([Replit Docs: Troubleshoot publishing](https://docs.replit.com/cloud-services/deployments/troubleshooting))

## Not supported

- Custom backends and VPS/Docker setups are quoted separately.
- More than one Supabase project in one order; it needs separate orders.
- Apps with more than 25 user-defined tables are declined or quoted separately.
- Apps with no Supabase and no server code. There's nothing on our checklist to fix, so we decline them.

See [What we check and fix](https://patchandship.com/docs/what-we-check) for the full checklist. Not affiliated with Lovable, Bolt, Replit, Cursor or Supabase.

## About PatchAndShip

PatchAndShip fixes security gaps in Lovable, Bolt, Replit and Cursor apps on Supabase, and with Fix & Deploy gets them live. From $149. Within 48 hours of working access or a full refund. Contact: patchandship@gmail.com · https://patchandship.com/ · Not affiliated with Lovable, Bolt, Replit, Cursor or Supabase.