Lovable or Cursor silently broke my login after an update. How do I fix it?

AI builders edit more than you asked for. A prompt like "clean up the header" can also rename a route, regenerate the auth context, or swap an env var name. Login is especially fragile because it depends on several pieces lining up:

• the Supabase client file and its env var names
• the auth provider or context that listens to onAuthStateChange
• route guards (ProtectedRoute, middleware) that redirect signed-out users
• the login page route and its form handler
• the redirect URLs in your auth settings

Builders report the same silent breaks again and again: a route guard that now redirects in a loop, a login route moved from /login to /auth, a form handler replaced with a placeholder, an env var renamed (for example from ..._ANON_KEY to ..._PUBLISHABLE_KEY) without updating the host, or a migration that changed an RLS policy.

1. Confirm what's broken, on the live site. Open a private window on your published URL. Does the login page load? Does the form show? What does the browser console say when you submit? Write down the exact error.

2. Roll back first, investigate second.

• Lovable / Bolt: use the project's version history to restore the last version where login worked, then republish.
• Cursor / Windsurf / Copilot / Claude Code: restore the checkpoint, or check out the last good commit with git log and git revert <bad-commit>.
• Replit: use the checkpoint or rollback in the agent history.

3. Diff only the auth surface. In git:

git diff <good-commit> <bad-commit> -- \
  src/integrations src/lib/supabase* src/contexts src/hooks \
  src/components/*Protected* src/pages/*Login* src/pages/*Auth* \
  middleware.ts proxy.ts .env.example

Look for changed env var names, a removed onAuthStateChange subscription, new redirects in guards, changed routes, and placeholder or mock submit handlers.

4. Check the settings the AI can't see. Make sure the Site URL and Redirect URLs still match your domain, and that the env vars on your host match the names the code now reads. Then rebuild, because env vars are baked in at build time.

5. Re-apply what you wanted, narrowly. Commit first, then prompt with clear limits (see the fix prompt below).

6. Make it routine. Commit before every AI task, review the file list the AI changed, and do one private-window login on the live URL after each publish.

Paste this into Lovable, Bolt, Cursor, Claude, ChatGPT, Replit, v0 or whichever tool you build with. Replace the bracketed parts first.

Login on https://yourdomain.com broke after the last change. The error is: [paste console error or describe what happens].
Do not touch anything except what is needed to restore login.
1. List every file you changed in the last edit that relates to auth: the Supabase client, the auth context or provider, route guards or middleware, login and signup pages, routes, and env var names.
2. Restore the previous working behaviour for those files. Keep the same login URL, the same env var names and the same redirect URLs.
3. Don't change the design, the database schema or RLS policies.
4. After the change, tell me exactly how to verify login in a private window on the live domain.

This is the problem Heedza was built for. An AI edit can ship a broken login page and your homepage stays green on every uptime monitor.

Heedza opens your live landing, signup, login and checkout pages in a real browser on a schedule: daily on the free plan, or every 60, 30 or 15 minutes on paid plans. It checks that each page loads and shows its form, and when one breaks it emails you a screenshot and a fix prompt written for your tool (Lovable, Bolt, Cursor, Claude, ChatGPT and others). It doesn't type passwords, so a form that still renders but fails on submit needs your own post-publish login test. Start with the free scan of your live URL.