Free fixes / Card 2

Hardcoded localhost

Symptom

API calls, auth redirects, webhooks, or images work on your laptop and fail (or loop) in production.

Plain English

The AI often hardcodes http://localhost:3000 (or a local API URL). Production browsers cannot reach your laptop, so those URLs break the moment you ship.

Checklist

1. Search the repo for localhost, 127.0.0.1, and 0.0.0.0.
2. Replace with an env-based site URL (for example NEXT_PUBLIC_APP_URL or SITE_URL).
3. Set that URL to your real production domain on the host.
4. Update any OAuth / webhook "callback" settings to the production URL too.
5. Re-test login, one API call, and one redirect on the live URL.

Paste-ready fix prompt

Paste this into Cursor, Claude, Copilot, Lovable, Bolt, or whichever coding agent you use.

Search this codebase for hardcoded localhost / 127.0.0.1 URLs in client and server code.

1. List every hit with file and line.
2. Replace them with a single env-based base URL pattern appropriate for this stack.
3. Tell me the exact env var names to set locally and in production.
4. Call out any third-party dashboards (OAuth, webhooks, Supabase redirects) that must use the production URL.
5. Do not change unrelated features.