Short notes on SEO, GEO and AI crawlers, from the sites and apps we build. Each one starts with the answer, uses numbers we measured ourselves or sources you can check, and lists those sources at the end.
Lovable uses one credit balance for building and for running your app, so when credits run out the published site stays live but building stops, AI features fail and a Cloud backend can pause. A live app costs a builder plan, database and hosting, AI, email and a domain. Usage limits, alerts and a separate run budget keep it predictable.
Read the noteThe Supabase key in your browser is meant to be public; what protects your data is row level security. The common gaps are tables with RLS off, policies that let everyone through, policies that trust user-editable data, views that skip RLS and a secret key in browser code. Supabase's Security Advisor and a two-account test find most of them.
Read the noteThe Bolt preview runs in your browser, while the published site is a set of prebuilt files on Bolt hosting, so things can work in one and fail in the other. Check six things in order: that you clicked Update, the redirect rule for routes, the build output, browser values and secrets, sign-in addresses and database permissions.
Read the noteEmergent's help centre says you keep full ownership of what you build. Code leaves through Save to GitHub on paid plans or by copying from the VS Code view; there is no download button. Secrets stay on the platform, the MongoDB data moves by hand, and production exports go through support. Move code, secrets, data and AI keys in that order.
Read the noteThe front end of a Lovable app moves to Cloudflare Workers easily. The database does not: D1 uses SQLite semantics and cannot import a Postgres database directly, and sign-in, row level security, file storage, realtime and edge functions all need replacements. If you mainly want Cloudflare hosting, keep Supabase and connect to it.
Read the noteWhen each AI edit breaks something else, stop asking for fixes. Go back to a known-good version, then put four guards in place: version control outside the builder, tests for the flows that matter, one small scoped change at a time, and a review of every change before it goes live. This is our own method, with the builder docs that support each step.
Read the noteWhen sign-in works in the Lovable preview but fails on the published app or a custom domain, the usual cause is that the live address is missing from the app's redirect URLs. Check four things in order: the redirect URL list, your own Supabase settings, Google sign-in and email confirmation.
Read the noteA new site can take days to be indexed, so first rule out waiting. Then ask Google what it saw, using the URL Inspection tool and the Page indexing report, and fix by status: noindex, robots.txt, sitemap, canonical, redirects and pages Google cannot read.
Read the noteA page looks blank to a crawler when the HTML the server sends has no text and JavaScript builds the page afterwards. Google runs that JavaScript, but a December 2024 study found the major AI crawlers did not. Whether your Lovable or Bolt site is affected depends on how it was built, so test it.
Read the noteLovable and Bolt document how to export code, through GitHub sync and a zip download. We could not confirm Emergent's steps in its own documentation. Code is only part of an app: the database, storage, sign-in settings and secrets must move too, or the exported app will not run.
Read the noteCloudflare will retire 24 Workers AI models on 20 November 2026, including 16 LLMs. Calls to a retired model fail with HTTP 410 and error code 5028. Search your code, config and AI Gateway logs for the model IDs, then switch to a current model.
Read the noteBubble says an AI-powered threat actor has targeted the platform and its apps since mid-October 2026. Bubble secures the platform; you secure your app's logic. A 15 minute pass over privacy rules, API keys, backend workflows, plugins, admin checks, rate limits and logs covers the basics.
Read the noteBubble's release notes of 7 October 2026 say Agent 2 is out of beta and available on every app, including existing apps. Before it edits a live app, work on a branch, take a savepoint, then review privacy rules, touched workflows, workload unit impact and rewritten expressions.
Read the noteApps that build their pages in the browser send crawlers an almost empty HTML shell. Google runs the JavaScript and sees the page, but most AI crawlers do not, so they receive a page with no readable text. The fix is to serve those crawlers a pre-rendered copy of the same content.
Read the noteLook at the raw HTML your server sends, before any JavaScript runs, and search it for your headline and key facts. You can view the page source, fetch the page with a crawler's user agent, or run a free GEO audit. If your text is not in the raw HTML, most AI crawlers cannot read it.
Read the noteAI companies run three kinds of bot: search crawlers that decide whether an assistant can cite you, training crawlers that collect data for future models, and fetchers that visit a page when a person asks. You can block training and still be cited, but blocking the search crawlers removes you from those assistants' answers.
Read the noteJSON-LD structured data sits in the page HTML as plain text, so every crawler can read it, whether or not it runs JavaScript. Use it to state your business name, location, services, prices and FAQs, exactly as they appear on the page.
Read the noteThere are three practical ways to get paid by AI today: Cloudflare's paid crawler access for web pages (pay per crawl, now being replaced by Pay Per Use, in beta since 30 September 2026), x402 for any HTTP API, and paid tools on an MCP server. We built our GEO audit as a pay-per-call API for agents over x402, which works from any country, and kept every page free to read.
Read the notePut the answer first, in plain text in the HTML, with the specific facts people ask about: what you do, where, for whom, what it costs and how to start. Keep one topic per page and the same facts everywhere. Nobody controls which sources an assistant cites, but vague pages give it nothing to quote.
Read the noteOn 12 and 13 November 2026 a Microsoft 365 outage left businesses worldwide without Outlook and other Microsoft services. If one company runs your email, staff sign-in, DNS and website, one outage stops all of them. A free scan of your public DNS records shows where you stand in about a minute.
Read the note