DEV Community: WaterShow

What changed in open models and AI agent tools this week

WaterShow — Sun, 01 Nov 2026 15:38:31 +0000

New open weights and agent tools shipped this week, alongside a security risk in a popular developer extension.

You get a new coding model to self-host, a way to build chat bots that remember past sessions, an Android agent that clicks buttons for you, and a reason to check your code editor extensions.

Mistral Large 4 open weights

Mistral released Mistral Large 4 as an open weights model. It is a 1-trillion parameter model trained on European infrastructure. The focus of this release is coding and defensive cybersecurity.

The model supports three reasoning modes. Low mode is for simple tasks. Medium mode handles everyday tasks. High mode is the default and is used for use cases requiring high precision.

It scores 48 percent on the Artificial Analysis Coding Agent Index. On the Artificial Analysis Cyber Index, it scores 51 percent. This index measures the ability of a model to discover vulnerabilities, reproduce them, and patch them. The model has a refusal rate of 96.6 percent on malicious cyber requests.

Persona AI SDK

The Persona AI SDK is a TypeScript package for building AI characters that remember past conversations. It separates the persona, memory, model, persistence, and interface into different layers.

You can store memory in-memory, as atomic JSON files, or in a SQLite database. The SDK includes adapters for OpenAI and Amazon Bedrock. It comes with default personas like atlas, a strategic analyst, and sage, a customer support agent.

To install the core runtime and adapters, run this command:

npm install persona-ai-sdk

If you want to use the SQLite storage adapter, you need to install the native dependency:

npm install better-sqlite3

Mika for Android

Mika is an open source on-device AI agent for Android written in Kotlin. It operates apps and websites for you. It runs on a hidden background screen so you can keep using your phone normally.

Mika looks at the screen and finds buttons visually. It does not rely on specific app APIs. You need to provide your own model API key or sign in with an account from providers like OpenAI or Anthropic.

The agent defaults to Ask mode. This mode asks for your permission before spending money or placing orders. You can also switch it to Autonomous mode. Mika includes a Linux sandbox for arm64 devices to run Python, Node, and shell commands on files.

To set up a model, configure it in the app settings.

Claude Code extension backdoor

Phorion found a backdoor in the official Claude Code for VS Code extension distributed on the Cursor Marketplace. The affected versions are 2.1.312 and 2.1.313. Cursor removed these versions from the marketplace.

The backdoor drops an SSH key appended to the authorized keys file. The key uses the comment svc-telemetry. It sets up a reverse SSH tunnel to an external server on port 22. The malware uses an embedded private key commented with svc-telemetry-tun to authenticate to the tunnel server.

The script establishes persistence using cron jobs on Linux, launch agents on macOS, and scheduled tasks on Windows. It also sends a beacon to the attacker. This beacon includes the hostname, username, public IP address, and up to 40 environment variable names that match keywords for secrets or cloud credentials.

On macOS, the setup script contains a bug. It runs a check for the remote login status without root privileges. The system prints an error and exits. The script treats this error as confirmation that SSH is already on. It skips the command to enable SSH entirely.

The catch

Mistral Large 4 is a 1-trillion parameter model. Running a model of this size requires significant hardware infrastructure.

The Persona AI SDK provides the building blocks for memory and personas, but horizontally scaled deployments require you to implement your own memory store using a database like PostgreSQL.

Mika needs Android 11 or later for basic chat and web browsing. Operating phone apps requires Android 12, but Android 14 or later is recommended. Operating third-party apps automatically with Mika may break their terms of service. Password entry pages often block screenshots, so Mika will ask you to take over manual control on those screens.

For the Claude Code backdoor, the macOS SSH bug breaks the inbound access path if SSH was not already running. The malware still successfully drops the SSH keys, installs persistence, and beacons host reconnaissance data back to the operator.

FAQ

What reasoning modes does Mistral Large 4 support?

Mistral Large 4 supports Low, Medium, and High reasoning modes. Low mode is for simple tasks, Medium is for everyday tasks, and High is the default for complex use cases.

Which versions of the Claude Code extension contain the backdoor?

Versions 2.1.312 and 2.1.313 of the Claude Code for VS Code extension on the Cursor Marketplace contain the backdoor. Cursor has removed these versions.

How does Mika interact with Android applications?

Mika looks at the screen and finds buttons visually. It runs on a hidden background screen and does not require specific app APIs.

Originally published at watershowdigital.com/blog/ai-updates-mistral-large-4-persona-sdk. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Fix slow Supabase queries caused by complex RLS policies

WaterShow — Sat, 31 Oct 2026 12:43:19 +0000

Your Supabase app feels fast when you test it alone. Then you launch, users add real data, and pages take seconds to load. You might see timeout errors in your Next.js app or a blank loading screen in your Lovable single page app.

The problem is rarely your frontend code. If the database is slow, it is usually because of Row Level Security (RLS) policies. When you write a database query in your application, Postgres takes the condition defined in your RLS policy and attaches it to your query.

If your RLS policy asks the database to look up a user's role in a different table, Postgres might perform that lookup for every row it scans. A query that returns 50 rows could trigger thousands of background lookups. You can test if RLS is the culprit by running the exact same query using your Supabase service_role key on a private backend. The service_role key bypasses RLS entirely. If the query is fast with the service_role key but slow in the browser, your policies are causing the slowdown.

1. Looking up roles in another table

If your policy uses a SQL statement to check another table, it forces Postgres into a nested loop. The most common case is checking a team members table or a user profiles table to see if the user has access to a document.

To confirm this is the issue, look at your policy definition in the project settings. If you see SQL that includes EXISTS (SELECT 1 FROM team_members WHERE ...) inside the policy, you are doing a table lookup. As your tables grow, this lookup gets slower.

The fix is to inject custom data directly into the user's auth token. Supabase allows you to set custom JWT claims using an auth hook. If you put the user's role or team ID directly into the token when they log in, the RLS policy can read it from memory instead of scanning the disk.

You can read the token data in your policy using a jsonb operator:

(auth.jwt() ->> 'team_id')::uuid = document.team_id

This changes the policy from a database read to a string comparison.

2. Writing complex logic without security definer functions

Sometimes you cannot avoid looking up data in another table. If your permission logic is complex and spans multiple tables, writing it directly in the RLS policy box makes the Postgres query planner struggle to optimize it.

Complicated joins inside the policy definition lead to poor execution plans.

The fix is to move the logic into a dedicated Postgres function and tell the policy to call that function instead. You must create the function using the SECURITY DEFINER keyword. This tells Postgres to run the function with the privileges of the user who created it, bypassing RLS checks for the tables queried inside the function itself. If you do not bypass RLS inside your RLS check, Postgres can get stuck in infinite recursion or extremely slow execution paths.

Create the function in the Supabase SQL editor:

CREATE OR REPLACE FUNCTION user_can_access_project(target_project_id uuid)
RETURNS boolean
LANGUAGE plpgsql
SECURITY DEFINER
AS $$
BEGIN
  RETURN EXISTS (
    SELECT 1 FROM project_members
    WHERE project_id = target_project_id
    AND user_id = auth.uid()
  );
END;
$$;

Then update your RLS policy to be a single function call:

user_can_access_project(project_id)

3. Missing indexes on policy columns

Postgres uses indexes to find rows without reading the entire table. If your RLS policy filters by a column that does not have an index, Postgres has to read every row in the table.

Look at the columns used in your RLS policy. If you have a documents table and the policy requires the user ID to match, Postgres needs to find all documents for that user. Open your table structure in the project settings to check if the column used in the policy has an active index.

If the column is not indexed, run a SQL command to add one:

CREATE INDEX idx_documents_user_id ON documents(user_id);

Adding an index to a column frequently checked by RLS drops query times.

4. Calling auth.uid() too many times

The built-in auth.uid() function is fast, but calling it multiple times in a complex policy can cause the query planner to evaluate the function repeatedly for every row instead of evaluating it once and reusing the result.

You can confirm this by looking at your policy text to see if auth.uid() appears multiple times in different OR and AND conditions.

Wrap the function call in a way that forces Postgres to evaluate it once. The cleanest approach is to use the security definer function method described above. By passing the user ID into a plpgsql variable, you guarantee the value is only computed once per query operation. You can also restructure your SQL to pull the auth.uid() check to the top level of the statement.

Still stuck?

If your queries are still timing out after simplifying your RLS policies, you might have a missing index on your main query or a frontend fetching problem. I can audit your Supabase database and fix the slow queries for you. this is the kind of fix I do.

FAQ

Why is my Supabase query timing out?

Your Row Level Security policies are likely running slow subqueries on every row. Postgres attaches your RLS rules to the query, turning fetches into background lookups.

How do I speed up RLS policies?

Add indexes to the columns your policies filter on. If you must do table lookups, move that logic into a Postgres function created with the SECURITY DEFINER keyword.

Can I read JWT claims in Supabase RLS?

Yes, you can read custom data stored in the auth token. Extract it using the auth.jwt() function in your policy, which avoids reading from the database entirely.

Originally published at watershowdigital.com/blog/fix-slow-supabase-queries-rls-performance. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to force Gemini API to return strict JSON in Node.js

WaterShow — Thu, 29 Oct 2026 16:45:40 +0000

You ask an AI model for a JSON response, and it gives you a markdown string starting with backticks and the word json. Your scraper or bot tries to run JSON.parse() on the output and immediately crashes.

We can fix this by forcing the Gemini API to return strict, raw JSON every time. Instead of trying to clean up the string with regular expressions, we will configure the Node.js SDK to lock the output format to a specific schema.

Setting up the Gemini SDK

First, you need the official Google Gen AI SDK for Node.js. If you are using the older version, update to the current @google/generative-ai package. You will also need your API key from the Google AI Studio dashboard. Click Get API key to generate a new one if you do not have it yet.

npm install @google/generative-ai

You must pass your API key into the client as an environment variable or a direct string. Keep this key secure. If you are building a web app, do not expose it to the browser.

Defining the output schema

To get strict JSON, pass two specific properties in the generationConfig object of your request: responseMimeType and responseSchema.

The responseMimeType tells the model to drop all conversational text and markdown formatting. Setting it to application/json ensures the raw string returned is just the JSON structure.

The responseSchema tells the model exactly what keys and data types to use. Gemini uses a subset of the OpenAPI schema format. You build this using the SchemaType enum provided by the SDK.

Here is an example schema for extracting product details from a block of text. We want an array of objects, where each object has a name, price, and category.

import { GoogleGenerativeAI, SchemaType } from "@google/generative-ai";

const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY);

const productSchema = {
  type: SchemaType.ARRAY,
  description: "A list of products extracted from the text",
  items: {
    type: SchemaType.OBJECT,
    properties: {
      productName: {
        type: SchemaType.STRING,
        description: "The official name of the product",
      },
      price: {
        type: SchemaType.NUMBER,
        description: "The price in USD",
      },
      inStock: {
        type: SchemaType.BOOLEAN,
        description: "True if the item is available",
      },
      category: {
        type: SchemaType.STRING,
        enum: ["electronics", "clothing", "home", "other"],
        description: "The product category",
      }
    },
    required: ["productName", "price", "category"],
  },
};

Using enum restricts the model to a predefined list of strings. Providing a clear description for each field acts as an inline prompt, guiding the model on what specific data belongs in that key.

Sending the request

Pass the schema to the model instance. You must use a model that supports structured outputs, such as Gemini 1.5 Pro or Gemini 1.5 Flash.

async function extractProducts(text) {
  const model = genAI.getGenerativeModel({
    model: "gemini-1.5-flash",
    generationConfig: {
      responseMimeType: "application/json",
      responseSchema: productSchema,
    },
  });

  const prompt = `Extract all the products from this text: \n\n ${text}`;

  const result = await model.generateContent(prompt);
  const response = result.response;

  const rawText = response.text();
  const parsedData = JSON.parse(rawText);

  return parsedData;
}

// Example usage
const sourceText = "We have a new Sony TV for 499.99. It is currently in stock. Also selling a cotton t-shirt for 15, but we are sold out.";

extractProducts(sourceText).then((data) => {
  console.log(data);
});

Because we set the MIME type, the response.text() method returns a clean JSON string. There are no backticks. You can immediately pass it to JSON.parse() without any string manipulation.

Handling complex nested structures

You can nest objects and arrays as deep as you need. However, every level of an array must define the items property, and every object must define the properties property.

If you want a response that includes metadata alongside the main data array, you start the schema as an object.

const documentSchema = {
  type: SchemaType.OBJECT,
  properties: {
    summary: {
      type: SchemaType.STRING,
      description: "A one sentence summary of the entire text",
    },
    tags: {
      type: SchemaType.ARRAY,
      items: {
        type: SchemaType.STRING,
      },
    },
    products: productSchema, // Reusing the schema from earlier
  },
  required: ["summary", "products"],
};

This modular approach makes it easier to manage large schemas. Build smaller pieces and reference them inside the main response schema.

Things that bit me

The model will still occasionally hallucinate keys if you do not strictly define the required array in your schema. If a field is optional, the model might omit it entirely or return null, which can break downstream code expecting a specific type.

Setting responseMimeType: 'application/json' without providing a responseSchema will return JSON, but the model decides the structure. It will change the keys based on the input text, making the output impossible to rely on for automated scripts.

Large outputs can get cut off if you hit the maxOutputTokens limit. The response will end in the middle of a string, and JSON.parse() will throw an error. You must check the finish reason in the response object or catch the parse error to detect this.

If your prompt explicitly tells the model to format the output as markdown, it will fight the SDK configuration. It might return invalid JSON that includes markdown syntax inside the string values.

If you need help building reliable extractions, you can check out other things I build.

FAQ

How do I stop Gemini from returning markdown code blocks?

Configure the generation settings with responseMimeType set to application/json. This tells the API to return the raw string without wrapping it in markdown backticks.

Do I need to provide a response schema?

If you only set the MIME type, the model will return JSON but it will invent its own keys. Providing a responseSchema forces the model to use the exact keys and data types you define.

Why does JSON.parse fail on the Gemini response?

The output might be cut off if it exceeds the maximum output tokens. Also, if your prompt contradicts the JSON settings, the model might include invalid characters inside the string.

Originally published at watershowdigital.com/blog/force-gemini-api-strict-json-nodejs. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Fix Stripe payment status not updating in Supabase

WaterShow — Wed, 28 Oct 2026 12:57:03 +0000

A user types in their credit card, the payment goes through, and Stripe charges them. They are redirected back to your app, but their account still says they are on the free plan. They refresh the page, but nothing changes.

This happens when the communication between Stripe and your Supabase database breaks down. Stripe knows the payment succeeded, but your app never processed it.

Fixing this requires looking at how your app listens for Stripe events.

1. Updating the database from the browser

Check your frontend code. If you run a Supabase update query right after the user returns from the Stripe checkout page, you cannot trust the browser to update the payment status. A user can close the tab before the redirect happens, which means the code to update Supabase never runs. They get charged, but their account remains locked. A malicious user can also fake a visit to the success page to grant themselves premium access without paying.

You need a webhook to handle this. A webhook is an API route on your server that Stripe calls directly when a payment succeeds. In a Next.js app, this is usually an API route. For a Lovable or Bolt single page app, this is often a Supabase Edge Function.

When a user pays, Stripe calls your webhook in the background. Your webhook then updates Supabase.

2. The webhook is using the wrong Supabase key

Go to your Stripe dashboard. Click on Developers and then click on Webhooks. Find your endpoint and look at the failed events. If you see HTTP 500 or 401 errors, your server is rejecting Stripe's request.

When Stripe calls your webhook, there is no logged-in user making the request. If your webhook tries to update the database using the standard Supabase anonymous key, Row Level Security will block it.

Your webhook code must use the Supabase service role key to bypass Row Level Security.

import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  process.env.SUPABASE_URL,
  process.env.SUPABASE_SERVICE_ROLE_KEY
)

The service role key gives full admin access to your database. It must never reach the browser. Keep it entirely in your server environment variables. In Next.js, ensure the variable name does not start with NEXT_PUBLIC_. In a Vite app, do not prefix it with VITE_.

3. The webhook secret is missing or mismatched

Check your webhook server logs. If your code verifies the Stripe signature and throws an error about a mismatch, your server will reject the payload.

Every Stripe webhook endpoint has a unique signing secret. It usually starts with whsec_.

Open the Stripe dashboard and go to your webhook endpoint settings.
Reveal the signing secret and copy it.
Add it to your server environment variables as STRIPE_WEBHOOK_SECRET.
Restart your local server or trigger a redeploy for your hosted backend.

Make sure your code uses this exact secret to construct the Stripe event before doing any database updates.

const event = stripe.webhooks.constructEvent(
  rawBody,
  signatureHeader,
  process.env.STRIPE_WEBHOOK_SECRET
);

If you test locally using the Stripe CLI, the CLI generates a different webhook secret for your local machine. You must use that local secret in your local environment file, and the live secret in your production environment variables.

4. Webhook retries and race conditions

A user upgrades, then cancels immediately. Your database shows them as upgraded, even though the cancellation event happened last.

Stripe sends multiple events like checkout.session.completed and customer.subscription.updated. Sometimes these arrive out of order. If your webhook fails or your server is slow, Stripe will retry sending the event for up to three days.

Your database updates must be idempotent. If the same webhook is processed twice, it should not break your data or create duplicate records.

To fix this, store the Stripe event ID in a dedicated Supabase table when you process it.

Create a table in Supabase called stripe_events with a single text column for the event ID.
Set the event ID column as the primary key.
In your webhook code, before updating the user profile, attempt to insert the event ID into this table.
If the database throws an error because the ID already exists, stop processing.
Return a 200 success code to Stripe so it stops retrying.

This ensures you process a specific payment event once, even if Stripe sends it to your server multiple times.

Still stuck?

If your Stripe and Supabase setup is still dropping updates or randomly failing, this is the kind of fix I do.

FAQ

Why is the Supabase service role key needed for Stripe webhooks?

Stripe webhooks run in the background without a logged-in user session. The service role key allows your server to bypass Row Level Security and update the user payment status.

How do I test Stripe webhooks locally?

You can use the Stripe CLI to forward webhook events to your local server. This provides a temporary webhook secret you can place in your local environment variables to verify your code updates Supabase.

What happens if my webhook server goes down?

Stripe will retry sending the webhook event for up to three days. Once your server is back online, it will receive the pending events and update Supabase.

Originally published at watershowdigital.com/blog/fix-stripe-payment-status-supabase. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Build an approve/reject Telegram bot flow in Node.js

WaterShow — Tue, 27 Oct 2026 15:26:48 +0000

We are building a Node.js Telegram bot flow that sends a message with inline Approve and Reject buttons. When you click a button, the bot processes the decision, updates the original message to reflect the choice, and removes the buttons.

This is useful for admin tasks like moderating user content, authorizing payments, or approving database writes.

Sending the message with inline buttons

To interact with the Telegram API, we will use the node-telegram-bot-api package. You will need a bot token from BotFather to authenticate your requests.

The bot sends a message containing an inline keyboard. Each button needs a callback_data string. This is the payload Telegram sends back to your server when the user clicks the button.

import TelegramBot from 'node-telegram-bot-api';

const token = process.env.TELEGRAM_BOT_TOKEN as string;
const bot = new TelegramBot(token, { polling: true });

async function sendApprovalRequest(chatId: number, userId: string, content: string) {
  const text = `New user signup pending approval:\n\nUser ID: ${userId}\nContent: ${content}`;

  await bot.sendMessage(chatId, text, {
    reply_markup: {
      inline_keyboard: [
        [
          { text: 'Approve', callback_data: `approve_${userId}` },
          { text: 'Reject', callback_data: `reject_${userId}` }
        ]
      ]
    }
  });
}

Listening for the callback query

When a user taps an inline button, Telegram sends a callback_query event to your bot. Listen for this event and extract the data string.

The callback_query object contains the data string you defined earlier, the message object, and a unique query ID. We split the string to separate the action type from the user ID.

bot.on('callback_query', async (query) => {
  const chatId = query.message?.chat.id;
  const messageId = query.message?.message_id;
  const data = query.data;

  if (!chatId || !messageId || !data) return;

  const [action, userId] = data.split('_');

  if (action === 'approve') {
    await approveUser(userId);
  } else if (action === 'reject') {
    await rejectUser(userId);
  }
});

async function approveUser(userId: string) {
  console.log(`Approved ${userId}`);
}

async function rejectUser(userId: string) {
  console.log(`Rejected ${userId}`);
}

Updating the message and clearing state

After you process the action, tell Telegram you received the callback by calling the answerCallbackQuery method with the query ID. If you skip this step, the button will show a loading spinner on the user's device for several seconds.

To remove the buttons, use the editMessageText method to replace the original text with a final status. Passing an empty array to inline_keyboard clears the buttons from the chat.

bot.on('callback_query', async (query) => {
  const chatId = query.message?.chat.id;
  const messageId = query.message?.message_id;
  const data = query.data;

  if (!chatId || !messageId || !data) return;

  const [action, userId] = data.split('_');
  let newText = query.message?.text || '';

  if (action === 'approve') {
    await approveUser(userId);
    newText += '\n\nStatus: Approved';
  } else if (action === 'reject') {
    await rejectUser(userId);
    newText += '\n\nStatus: Rejected';
  }

  await bot.editMessageText(newText, {
    chat_id: chatId,
    message_id: messageId,
    reply_markup: { inline_keyboard: [] }
  });

  await bot.answerCallbackQuery(query.id);
});

Things that bit me

The callback_data string has a hard limit of 64 bytes. If you try to stuff a long JSON object or a full URL into it, the Telegram API will reject the message and your bot will crash. Store complex state in your database and only pass short IDs in the callback data.

Multiple people in a group chat can click the buttons at the exact same time. If the message is in a shared group, your bot might receive and process duplicate callback requests before the first one finishes editing the message. You should handle idempotency in your database logic so a record is not approved twice.

FAQ

How do I stop the button from spinning in Telegram?

Call answerCallbackQuery with the query ID. This tells the Telegram app that your server received the click and stops the loading spinner.

How do I remove the inline buttons after a click?

Use the editMessageText method on the original message. Pass an empty inline_keyboard array in the reply_markup property to clear the buttons.

Why does my Telegram bot fail to send the inline keyboard?

Your callback_data string might be too long. Telegram limits the callback data to 64 bytes. Pass short identifiers instead of large payloads.

Originally published at watershowdigital.com/blog/telegram-approve-reject-bot-nodejs. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Why Google and ChatGPT can't see your Lovable app (and how to fix it)

WaterShow — Mon, 26 Oct 2026 20:59:22 +0000

You built the app in Lovable, Bolt or v0, it works, people like it. Then you search for it on Google and get nothing useful, and when you ask ChatGPT about your product it has never heard of it.

Most of the time the app is fine. The problem is what search engines and AI assistants receive when they open your link.

What a crawler actually downloads

Apps from AI builders are usually single-page React apps. When anyone opens the link, the server sends a tiny HTML file that looks roughly like this:

<body>
  <div id="root"></div>
  <script type="module" src="/assets/index-a1b2c3.js"></script>
</body>

Your headings, prices, features and contact details are not in that file. They appear only after the browser downloads and runs the JavaScript. People never notice, because their browser does it in a second.

Who runs JavaScript and who doesn't

Google can run JavaScript, but it does it in a second pass that can come days later, and pages with heavy scripts sometimes get indexed with missing text or not at all.

AI assistants are worse off. The crawlers behind ChatGPT, Claude and Perplexity mostly read the HTML and do not run JavaScript. In Vercel's analysis of AI crawler traffic, none of the major AI crawlers rendered JavaScript. For them your app is an empty div.

So the same page that looks great to a visitor can be invisible to the tools people now use to find products.

Check your app in 30 seconds

The quickest way: paste your link into the free visibility check. It shows how many words of your content are in the HTML, plus the title, description, link preview, sitemap, robots.txt, llms.txt and mobile speed, each with what to fix.

If you prefer to do it by hand, open your site and press Ctrl+U (or Cmd+Option+U on a Mac) to view the page source. Search for a sentence that is visible on the page. If you cannot find it in the source, crawlers cannot find it either.

Five fixes, from easiest to most thorough

1. Put the basics in index.html. Even a single-page app has one real HTML file. Give it a proper <title>, a meta description, Open Graph tags for link previews and a canonical link. In Lovable you can ask it to edit index.html, or change it in the code on GitHub. This alone fixes how your link looks in search results and chats.

2. Add robots.txt, sitemap.xml and llms.txt. Put them in the public folder so they are served from the root of your domain. The sitemap lists your pages, robots.txt points crawlers to it, and llms.txt is a short plain-text summary of what your site offers, written for AI assistants.

3. Add structured data. A small JSON-LD block in index.html that says who you are, what you sell and where you are. Google and AI assistants use it to describe your business without guessing.

4. Prerender your public pages. This is the fix that actually puts your text into the HTML. A prerender step runs your app at build time and saves the finished HTML for each public route (home, pricing, features, blog). Visitors still get the full app, but crawlers receive real content. For a Vite app like the ones Lovable and Bolt generate, this is usually a plugin plus a list of routes to render.

5. Move the marketing pages to a framework that renders on the server. If content and search traffic matter a lot, keep the logged-in app where it is and build the public pages with Next.js or Astro, which send full HTML by default. It is more work, but it is the most robust option.

For most apps, steps 1 to 4 are enough and take a day or two.

What I usually find

When I check apps built with AI tools, the pattern is almost always the same: a generic title like "Vite + React", no description, no link preview image, no sitemap, and fewer than twenty words of real content in the HTML. Each piece is small, but together they make the product invisible outside of direct links.

If you want it done for you, I fix exactly this: prerendering, meta tags, link previews, sitemap, robots.txt, structured data and llms.txt, with a fixed quote first. Run the free check and send me the report.

FAQ

Can Google index a Lovable app at all?

Yes, but slowly and not always completely. Google renders JavaScript in a second pass, so pages can sit unindexed for days or get indexed with missing text. Putting real text into the HTML with prerendering removes the guesswork.

Why does ChatGPT not know about my product?

The crawlers that feed ChatGPT, Claude and Perplexity mostly read only the HTML and do not run JavaScript. If your content appears only after scripts run, they see an empty page and have nothing to quote.

Do I need to rebuild my app to fix this?

Usually not. Fixing index.html, adding a sitemap, robots.txt, llms.txt and structured data, and prerendering the public pages keeps your app as it is. Moving marketing pages to Next.js or Astro is only worth it when search traffic really matters.

Originally published at watershowdigital.com/blog/why-chatgpt-cant-see-your-lovable-app. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to get Reddit data in 2026 now that the API is closed

WaterShow — Mon, 26 Oct 2026 02:07:47 +0000

If you tried to create a Reddit app recently, you hit a wall. Since November 2025 Reddit no longer hands out API keys on request: every new app needs manual approval under the Responsible Builder Policy, and personal or small commercial projects are often turned down or never hear back. Even automation tools like Make and Pipedream now ask you for your own approved Reddit app before they connect.

So what do you do if you just need posts and comments for research, lead generation or monitoring? Here are the options that still work, from simplest to most capable.

1. RSS feeds, for light monitoring

Almost every Reddit listing has an RSS version. Add .rss to the URL:

https://www.reddit.com/r/SaaS/new/.rss
https://www.reddit.com/search.rss?q=looking+for+a+crm&sort=new
https://www.reddit.com/r/SaaS/comments/abc123/.rss

You get titles, full post text, authors and dates, up to 100 items per request. Good enough to watch a few subreddits or keywords.

The limits: no scores, no comment counts, and Reddit rate limits RSS hard. If you poll more than a few times a minute from one IP you start getting 429 Too Many Requests. Combine several subreddits into one feed (/r/a+b+c/new/.rss) to make fewer requests.

2. Apply for API access anyway

If you need to post or vote, the API is the only legitimate way, so it is worth applying. Use the support request form on reddithelp.com, describe one concrete use case, the volume, and how you handle data. Be honest about commercial use. Expect anything from a week to no answer at all, so do not build a business that depends on it.

3. A scraper that reads public pages

For anything bigger than a few feeds, you want a tool that reads Reddit's public pages for you, handles rate limits and gives you clean data. I built Reddit Scraper & AI Lead Finder for this. It needs no API key and no Reddit login:

search posts by keyword, sitewide or inside subreddits
pull new, hot, top or rising posts from any subreddit
get posts from a user profile, or comments from a post URL
scores, comment counts, upvote ratio and full text, ready for CSV or JSON

{
  "searchQueries": ["looking for a crm", "alternative to hubspot"],
  "subreddits": ["SaaS", "startups"],
  "sort": "new",
  "timeRange": "week",
  "maxPostsPerSource": 100
}

It costs $1 per 1,000 posts. If you add a short description of what you sell, its optional AI mode scores each post for buying intent and drafts a reply, which turns it into a lead finder rather than a plain scraper.

Which one to pick

Watching a few keywords for yourself: RSS feeds and a small script.
Research, dashboards, lead lists, anything over a few hundred posts a day: a managed scraper.
Posting, voting or messaging: only the official API. Do not automate those any other way, Reddit bans accounts for it.

Play fair

Whatever you use, stick to public data, keep request rates reasonable, and do not collect personal information you do not need. Reddit is a community first. Tools that read it to find people who need help are fine. Tools that spam it get everyone blocked.

FAQ

How can I read Reddit posts without an API key?

You can use RSS feeds for light monitoring by adding .rss to Reddit URLs. For pulling larger amounts of data for research or dashboards, you can use a managed scraper. Scrapers read public pages without needing an API key or a Reddit login.

What data is included in a Reddit RSS feed?

A Reddit RSS feed provides the titles, full post text, authors and dates for up to 100 items. It does not include post scores or comment counts. You also have to be careful with rate limits to avoid getting error messages.

Can I still automate posting and voting on Reddit?

Only through the official API. Since November 2025 every new Reddit app needs manual approval under the Responsible Builder Policy, and small projects are often turned down. Automating posting or voting any other way gets accounts banned.

Originally published at watershowdigital.com/blog/reddit-data-without-api-2026. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Lovable app works in preview but breaks after deploy? Seven fixes

WaterShow — Mon, 26 Oct 2026 02:07:46 +0000

Everything works in the Lovable preview. You deploy it to your own domain on Vercel or Netlify, and suddenly login loops, pages go blank or the data never shows up.

The app is almost never "broken". Something that the preview handled for you is missing in production. Here are the seven causes I see most often, in the order I check them.

1. Supabase still redirects to localhost or the preview URL

Symptom: you log in, and you land on localhost:3000 or the old preview link, or you end up back on the login page.

Fix: in Supabase go to Authentication → URL Configuration.

Site URL: your real domain, for example https://myapp.com
Redirect URLs: add https://myapp.com/** (and your Vercel preview domain if you use it)

If you use Google or GitHub login, the provider's own console needs the Supabase callback URL too: https://<project>.supabase.co/auth/v1/callback.

2. Environment variables are missing on the host

Symptom: blank page, or errors like supabaseUrl is required in the browser console.

Lovable keeps your keys in the project. Vercel and Netlify do not know them. Add them in the host's settings:

VITE_SUPABASE_URL=https://xxxx.supabase.co
VITE_SUPABASE_PUBLISHABLE_KEY=...

Then redeploy. Variables are baked in at build time, so changing them without a new build does nothing.

3. Refreshing a page gives a 404

Symptom: the home page works, but refreshing /dashboard or opening it from a link shows "404 Not Found".

Lovable apps are single page apps: there is only one real index.html. Tell the host to send every route to it.

Vercel, vercel.json in the project root:

{ "rewrites": [{ "source": "/(.*)", "destination": "/index.html" }] }

Netlify, a file public/_redirects:

/*  /index.html  200

4. RLS blocks the data in production

Symptom: the page loads but lists are empty, or saving fails with new row violates row-level security policy.

In the preview you might have been testing as a different user, or with policies that changed since. Check that every table your app reads has a select policy for logged in users and every table it writes has a matching insert or update policy. I wrote a separate guide on the six causes of RLS insert errors.

5. The service role key ended up in the frontend

Symptom: everything works, which is the dangerous part.

If your code creates the Supabase client with the service_role key, anyone can open the network tab, copy it and read or delete your whole database. Search your code for service_role. In the browser only the publishable (anon) key belongs. Anything that needs full access moves to an Edge Function.

6. Stripe works in test mode only

Symptom: checkout opens, payment succeeds, but the user never gets access.

Usually the webhook is still pointing at the test endpoint or uses the test signing secret. In Stripe switch to live mode, create the webhook for your production URL, and put the live STRIPE_WEBHOOK_SECRET into your function's secrets.

7. Emails go nowhere

Symptom: sign up works but the confirmation email never arrives.

Supabase's built in email is rate limited and meant for testing. For real users, connect your own SMTP (Resend, Postmark, SendGrid) under Authentication → SMTP Settings, and add the DNS records your provider asks for so emails do not land in spam.

Still stuck?

Open the browser console (F12) and the network tab, reproduce the problem and read the first red error. Nine times out of ten it names the cause. If it does not, or you would rather not spend the weekend on it, this is the kind of fix I do: fixed price up front, usually done in 48 hours.

FAQ

Why do I get a 404 error when I refresh my Lovable app?

This happens because Lovable apps are single page apps with only one real index.html file. To fix it, you need to tell your host to send every route to that file. You do this using a vercel.json file for Vercel or a public/_redirects file for Netlify.

Why is my Supabase data not loading after I deploy?

Your environment variables might be missing from your Vercel or Netlify settings. If you add them, you must redeploy your app since variables are baked in at build time. It is also possible that your row-level security policies are blocking the data.

Why am I redirected to localhost after logging in?

This occurs when Supabase still redirects to your old preview link or localhost. Go to the URL Configuration under Authentication in Supabase to fix this. Update your Site URL to your real domain and add it to your Redirect URLs.

Originally published at watershowdigital.com/blog/lovable-app-breaks-after-deploy. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to see every Google ad your competitor runs (and what to steal from them)

WaterShow — Mon, 26 Oct 2026 02:02:33 +0000

Your competitor has been testing ads for months and paying for every lesson. You can see the results for free, because Google publishes every ad in the Ads Transparency Center: Search, YouTube and Display, with the dates each ad ran and the countries it was shown in.

Most people never open it. Here is how to use it properly.

The manual way, for one competitor

Open adstransparency.google.com.
Type the competitor's domain, for example notion.com, and pick the advertiser from the list. Big companies often have several verified advertiser accounts, one per country or product.
Pick a country in the top bar. Without it you see ads from everywhere.
Switch the format filter between text, image and video.
Click an ad to see its versions, the countries it ran in and, for the EU, roughly how many times it was shown.

This works fine for a quick look at one brand. It gets painful when you want 300 ads from five competitors in a spreadsheet, with the ad text you can actually search and sort.

The fast way: pull everything into a table

I built a small tool for this: Google Ads Spy on Apify. You give it domains or advertiser names, it returns one row per ad:

headline, description and call to action
landing page URL (where the ad actually sends people)
the YouTube link for video ads
first and last date shown, and how many days the ad ran
countries, and impressions where Google publishes them

{
  "domains": ["notion.com", "clickup.com", "monday.com"],
  "region": "US",
  "format": "video",
  "maxAdsPerSource": 100
}

It costs $1.50 per 1,000 ads with full details, so a full teardown of three competitors is well under a dollar. If you also have a Meta Ad Library API token, the same run pulls their Facebook and Instagram ads.

What to look for once you have the list

1. The ads that never stop

Sort by how long each ad has been running. An ad that has run for 120 days is almost certainly profitable, nobody keeps paying for a loser that long. Those are the messages to study first.

2. The landing pages

Group ads by landing page URL. You will usually find two or three pages that get most of the ads. That tells you which offer converts for them: a free trial, a demo, a template gallery, a comparison page against you.

3. The angle, not the wording

Do not copy the headline. Write down the angle behind it: speed ("set up in 5 minutes"), price ("free for teams under 10"), pain ("stop chasing invoices"), social proof ("used by 50,000 teams"). Then test the same angle in your own words.

4. Where they spend

The country list shows where they are pushing. If a competitor suddenly starts running ads in Germany, they are probably launching there. If they stopped in a market, it probably did not pay off.

5. Video hooks

For YouTube ads, watch only the first five seconds of each. That is the hook they paid to test. Collect the ones that keep running and you have a swipe file of hooks that work in your niche.

A simple weekly routine

Run the same input once a week with "only running ads" turned on and save the results. Compare with last week:

new ads mean they are testing something
ads that disappeared were probably losing
a new landing page means a new offer

Twenty minutes a week and you always know what your competitors are betting on, without paying for their mistakes.

Good to know

Search ads are published as an image of the ad, so for those you get a screenshot rather than separate text fields.
Impression numbers are only published for ads shown in the EU.
This is public data Google shows on purpose, so anyone can check who advertises what. Use it to learn, not to clone someone's brand.

FAQ

How much does it cost to download competitor Google ads?

Using the Google Ads Spy tool on Apify costs $1.50 per 1,000 ads to pull the data into a table. Viewing the ads manually in the Google Ads Transparency Center is completely free.

Can you see how many impressions a competitor ad gets?

Google only publishes impression numbers for ads shown in the European Union. For ads shown in other regions, you can see the active dates and countries but not the impression counts.

How do you know if a competitor Google ad is profitable?

You should look at how long the ad has been running. If an ad stays active for a long time, it is almost certainly profitable because advertisers do not keep paying for losing ads.

Originally published at watershowdigital.com/blog/see-competitor-google-ads. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to find Substack newsletters to sponsor (with real subscriber counts)

WaterShow — Mon, 26 Oct 2026 02:02:32 +0000

Newsletter sponsorships are one of the few ad channels where people still read the ad. The catch is finding the right newsletters: ones your customers actually read, that are still active, and that are big enough to matter but small enough to afford.

Substack hosts thousands of them. Here is how to build a shortlist.

What makes a newsletter worth sponsoring

Before you search, decide what "good" means for you:

Fit. The topic matches your customer, not just your industry. A newsletter about "AI tools for lawyers" beats a general AI one if you sell to law firms.
Size. Subscribers between 2,000 and 50,000 are usually the sweet spot for small budgets. Big names are expensive and often sold out.
Activity. It posts every week or two. A newsletter that last posted three months ago is dead, whatever its subscriber count says.
A paid tier. Writers with paying readers usually have a more engaged audience.
A real person you can reach. You need an email, X or LinkedIn to pitch them.

The manual way

Go to substack.com and search your topic.
Open each newsletter, note the subscriber count if it is shown, and check the date of the last post.
Look at the "About" page and the author profile for contact links.
Put everything in a spreadsheet.

It works, but it is slow: 10 to 15 minutes per newsletter, and many hide the subscriber count on their own page.

The fast way

I built Substack Newsletter Finder for exactly this. You give it keywords or categories and it returns a table:

newsletter name and URL
subscriber count and the author's follower count
the author's X, LinkedIn, YouTube and website links
last post date and how many posts in the last 30 days
language and whether it has a paid plan

{
  "searchQueries": ["b2b saas", "startup marketing"],
  "minSubscribers": 2000,
  "activeWithinDays": 30,
  "language": "en",
  "maxResults": 200
}

200 newsletters cost about $0.50. Filter by subscribers and activity, sort, and you have a shortlist in a few minutes.

How to pitch

Keep the first email short and specific:

one line on why their audience fits ("your readers are early stage founders, we make invoicing for them")
what you want: one sponsored slot in an upcoming issue
ask for their rate, or offer one if they do not have a media kit

Start with three to five newsletters, not fifty. Run one slot each, track signups with a separate link or code per newsletter, and only rebook the ones that paid back.

Read before you buy

Before paying, read the last five issues. Check that the writing is good, that ads are clearly marked and not stuffed in, and that readers reply or comment. Ten minutes of reading saves you from buying space in a newsletter nobody opens.

A shortcut for writers too

If you run a newsletter yourself, the same list works in reverse: find newsletters of a similar size in your niche and propose a cross promotion. Both of you grow, nobody pays.

FAQ

How do I find the subscriber count for a Substack newsletter?

You can look for the subscriber count manually by opening each newsletter on Substack, though many writers hide this number. Alternatively, you can use the Substack Newsletter Finder tool to automatically pull subscriber counts for a list of newsletters.

What is a good subscriber size for a newsletter sponsorship?

Subscribers between 2,000 and 50,000 are usually the best option for small budgets. Larger newsletters are often expensive and sold out.

How do I pitch a sponsorship to a Substack writer?

Keep your first email short and explain why their audience fits your product. Tell them you want one sponsored slot in an upcoming issue. You should also ask for their rate or offer a price if they lack a media kit.

Originally published at watershowdigital.com/blog/find-substack-newsletters-to-sponsor. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

How to find customers on Reddit without spamming (or getting banned)

WaterShow — Mon, 26 Oct 2026 01:57:10 +0000

Every day somebody on Reddit writes "can anyone recommend a tool for..." or "I'm stuck with this, willing to pay someone to fix it". If you sell that thing, this is the warmest lead you will ever get: they asked first.

The problem is finding those posts before 40 other people answer, and replying without looking like a spammer. Here is the approach that works for me.

Step 1: know what a buying post looks like

Most posts in your niche are not leads. Discussions, launches and memes are noise. Buying intent sounds like this:

"looking for a tool / app / service that..."
"any alternative to X?" (they are unhappy with a competitor)
"willing to pay", "budget is", "hiring", "need someone to"
"how do I fix..." followed by a very concrete broken thing
"we tried X and it didn't work"

Write down 10 to 20 phrases like these for your product. They become your search queries.

Step 2: search the right places

Reddit search is decent if you sort by new. Try queries like:

"alternative to hubspot"
"looking for a crm"
"need help with supabase"

Then list the subreddits where your customers hang out. Not the big general ones: the small, specific ones where people describe their actual problems. For a dev service that might be r/Supabase, r/nextjs, r/SaaS, r/indiehackers, r/forhire.

Checking all of that by hand every day takes an hour. I built Reddit Scraper & AI Lead Finder to do it: you give it search queries, subreddits and a short description of what you sell, and it returns the posts with an intent score, the pain point and a draft reply. You can schedule it every few hours and only look at posts that scored 7 or higher.

Step 3: answer like a person, not a brand

This is where most people burn their account. Rules I follow:

Help first. Give one concrete, useful tip for their exact problem. If your reply is useful without your product, you are doing it right.
Keep it short. Two or three sentences. Nobody reads a wall of text from a stranger.
No links in the first reply. Links from new accounts get filtered or downvoted.
One soft offer at the end. Something like "I can help you set this up if you want, just message me." That is it.
Sound like yourself. No "Great question!", no bullet points, no corporate tone.

A good reply looks like this:

sounds like your redirect URL in Supabase auth still points to localhost, check Authentication then URL configuration. i fix this kind of thing for people, message me if you want a hand

Step 4: move to DMs, then close

When someone replies "yes please" or sends a DM, the hard part is over. Ask one or two questions about their setup, give a fixed price, and offer to start today. Speed wins here: the person who answers within an hour usually gets the job.

How not to get banned

Read each subreddit's rules. Some ban any self-promotion, respect that.
Do not post the same reply twice. Reddit spots copy-paste fast.
Keep the ratio healthy: most of your comments should be plain help with no offer at all.
A few good replies a day beat fifty lazy ones.

What to expect

Most replies go nowhere, and that is fine. You are playing a numbers game with very warm leads: a handful of helpful replies a day, a few conversations a week, and every now and then someone who says "can you just do it for me". It costs half an hour a day, and the people you talk to came asking for help.

FAQ

How do I find people who want to buy on Reddit?

You should look for posts where people specifically ask for tools, alternatives, or help fixing a concrete problem. Search for these buying phrases in small, specific subreddits where your customers actually hang out. You can check these manually or use a tool like Reddit Scraper & AI Lead Finder to automate the search.

Should I put links in my Reddit comments?

Do not include links in your first reply to a user. Links from new accounts often get filtered out or downvoted. Instead, offer a helpful tip and tell the person to message you directly if they want more help.

How can I avoid getting banned when selling on Reddit?

Read the rules of each subreddit and respect any bans on self-promotion. Make sure most of your comments just offer help without pitching your product at all. Never copy and paste the same reply twice because Reddit spots this very quickly.

Originally published at watershowdigital.com/blog/find-customers-on-reddit. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.

Supabase RLS blocks your inserts? Six causes and how to fix each

WaterShow — Mon, 26 Oct 2026 01:57:09 +0000

You turned on Row Level Security, wrote a policy that looks right, and now every insert from your app fails with:

new row violates row-level security policy for table "todos"

The good news: this error almost always comes from one of six causes. Go through them in order and you will find yours in a few minutes.

1. There is no INSERT policy at all

When RLS is on, everything is denied until a policy allows it. A lot of apps have a policy for SELECT (often copied from a tutorial) but nothing for INSERT.

Check what you have:

select policyname, cmd, roles, qual, with_check
from pg_policies
where tablename = 'todos';

If there is no row with cmd = 'INSERT' (or ALL), add one:

create policy "users insert own rows"
on public.todos for insert
to authenticated
with check (auth.uid() = user_id);

2. The policy uses USING instead of WITH CHECK

For inserts, Postgres only looks at with check. A using clause is for rows that already exist (select, update, delete). If you wrote the insert rule into using, Postgres either rejects the policy or the insert still fails.

Rule of thumb:

select / delete: using (...)
insert: with check (...)
update: both, using for which rows you may touch, with check for what they may become

3. user_id is empty, so the check can never pass

Your policy says auth.uid() = user_id, but the client sends the row without user_id. Null is not equal to anything, so the check fails.

Either send it from the client, or better, let the database fill it in:

alter table public.todos
alter column user_id set default auth.uid();

Now the client can insert { title: "Buy milk" } and the row is still owned by the right user.

4. The request is not actually logged in

auth.uid() returns null when the request comes in as anon. This happens more often than you would think:

the user's session expired and the client did not refresh it
you call Supabase from a server route or an edge function with the anon key, but never pass the user's access token
the policy says to authenticated, while the request arrives as anon

On the server, create the client with the user's token, so Postgres knows who is asking:

const supabase = createClient(url, anonKey, {
  global: { headers: { Authorization: `Bearer ${accessToken}` } }
})

5. insert().select() also needs a SELECT policy

This one catches almost everybody. If you write:

const { data, error } = await supabase.from('todos').insert({ title }).select()

Supabase inserts the row and then reads it back. Reading it back is a select, so you also need a select policy for that row. Without it the whole call fails with the same RLS error, even though your insert policy is fine.

Either add the select policy:

create policy "users read own rows"
on public.todos for select
to authenticated
using (auth.uid() = user_id);

or drop the .select() if you do not need the row back.

6. A related table has its own rules

If your insert fires a trigger that writes into another table, or the policy itself runs a subquery on another table (for example "is this user a member of this team?"), those tables have RLS too. The check fails because the subquery returns nothing for this user.

Two ways out: give the user read access to the rows the check needs, or move the check into a security definer function that runs with the owner's rights. Keep that function small and only return what the check needs.

How to test a policy without guessing

The SQL editor in the dashboard runs as a superuser, which skips RLS. So a query that works there tells you nothing. Pretend to be the user instead:

begin;
set local role authenticated;
set local request.jwt.claims = '{"sub": "PASTE-A-REAL-USER-ID"}';

insert into public.todos (title) values ('test');

rollback;

If this fails, the problem is in your policies. If it works, the problem is in how your app sends the request (causes 4 and 5).

What not to do

Do not "fix" it by turning RLS off, and do not put the service_role key in the browser. Both make the error go away by giving everyone access to every row. The first person who opens the network tab gets your whole database.

FAQ

Why does Supabase insert().select() fail with an RLS error?

When you add the select method to an insert command, Supabase tries to read the row back after creating it. This means you need a select policy in addition to your insert policy. If you do not have a select policy, the entire call fails.

How do I test Supabase RLS policies in the SQL editor?

The SQL editor runs as a superuser and naturally skips RLS rules. To test a policy correctly, you need to write a transaction that sets the local role to authenticated and provides a real user ID. If the query works this way, your policies are fine and the problem is in your app code.

Should I use using or with check for an insert policy?

You must use with check for insert policies. Postgres only looks at the using clause for rows that already exist, such as when you select or delete data. If you write your insert rule with using, Postgres will reject it and the insert will fail.

Originally published at watershowdigital.com/blog/supabase-rls-blocks-inserts. Need a hand with your app or automation? WaterShow Digital fixes and builds it, fixed quote first.