Deployment & Ops

Smart Retries: Stripe's intelligent retry logic recovers 15-25% more failed payments than fixed schedules. Enable it in the Stripe dashboard under Billing settings. Card Account Updater automatically refreshes expired cards for existing subscriptions, which industry estimates suggest can cut hard declines by up to 30-50%.

Dunning Configuration: Configure up to 4 reminder emails per invoice before marking as unpaid. Each email is another chance to recover revenue. Businesses using Stripe's full dunning setup recover significantly more than basic email reminders alone.

Why this matters: AI scatters hardcoded price IDs like price_1234abc across your codebase. When you change plans, you miss half of them. Centralizing means one file to update for pricing changes.

Merchant of Record (MoR): LemonSqueezy and Paddle handle sales tax and VAT globally so you don't have to. Higher fees but zero tax compliance work. Choose MoR if you sell to international consumers.

Revenue Threshold: At $50K/month revenue, the fee difference between MoR (5% + $0.50) and Stripe (2.9% + $0.30) exceeds $1,000/month. Start with MoR for simplicity, migrate to Stripe as revenue scales.

Most vibe-coded apps reach an inflection point around $100K MRR where professional engineering becomes necessary. Signs: bugs take longer to fix than features take to build, every change breaks something else, or scaling issues are costing you customers.

npm audit checks every package in your project against a database of known security vulnerabilities and reports what it finds.

Recommendation: Just use Dependabot. It's free, built into GitHub, and requires zero setup beyond a config file. Enable it in your repo's Settings under Security. Renovate is more powerful but overkill for most vibe-coded projects. An empirical study of Dependabot found that automated dependency updates measurably reduce how long projects stay exposed to known vulnerabilities.

Redis caching stores frequently accessed data in memory instead of hitting your database every time. CDN setup (Cloudflare's free tier works) distributes static files worldwide. Database indexing works like a book's table of contents, add indexes on columns you frequently search, filter, or sort by.

The simplest approach uses an environment variable. No libraries needed.

This costs nothing but requires a redeploy to toggle. When you need real-time toggling without redeploying, consider these options:

Expo releases SDK updates on a quarterly cadence, tracking every other React Native release. The New Architecture (Fabric renderer, TurboModules) has been enabled by default since SDK 52, meaning all new projects get modern rendering performance out of the box.

Buffer 3-5 business days before any launch date. For first-time submissions, budget 1-2 weeks for Apple (including a likely rejection and resubmission) and 3-7 days for Google Play.

Hidden costs: Apple requires a Mac for Xcode (iOS development is Mac-only for local builds), both stores take 15-30% commission on in-app purchases, and you need a privacy policy URL before submitting.

1. 1

   App Completeness (Guideline 2.1): Crashes, broken links, placeholder content. Guideline 2.1 accounts for over 40% of App Store rejections. AI-generated code often handles only the "happy path" and crashes on edge cases.

2. 2

   Minimum Functionality (Guideline 4.2): Apps that are essentially a WebView wrapper get rejected. Apple requires native navigation, push notifications, offline support, and device-specific features.

3. 3

   In-App Purchase (Guideline 3.1.1): Using Stripe for digital goods instead of Apple's StoreKit. In the US, after the 2025 Epic v. Apple ruling, apps may link out to external payment for digital goods (Apple may still charge a commission on those external-link purchases). Outside that US carve-out, Apple requires StoreKit and takes 15-30%. Physical goods can always use external payment.

4. 4

   Spam/Copycat (Guideline 4.3): Too similar to existing apps without meaningful differentiation. AI tools generate similar-looking apps by design. Apple's automated systems detect duplicate code structures.

5. 5

   Data Collection (Guideline 5.1.1): Missing or inaccurate privacy policy. You need the privacy policy both in App Store Connect metadata and inside the app itself.

6. 6

   Sign in with Apple: Required if you offer any third-party social login (Google, Facebook, etc.). Either add Sign in with Apple or remove all social logins.

7. 7

   Permission Strings (ITMS-90683): Must explain why you need camera, location, or microphone access. Not "This app requires camera access" but "This app needs camera access to let you take profile photos."

8. 8

   App Tracking Transparency: Must show ATT prompt before any tracking. If the user denies tracking, you must stop all tracking immediately. No nagging or manipulation.

9. 9

   Missing Demo Account: Reviewers need working login credentials to test your app. Provide them in App Store Connect under App Review Information.

10. 10

    Account Deletion: Users must be able to delete their account from within the app. Linking to a website or email doesn't count. AI-generated auth flows almost never include this.

Always start with internal testing for zero-delay feedback. The 100-tester limit is generous for most indie scenarios. For wider testing, use external TestFlight with a public link where testers can join anonymously.

Expo handles both FCM (Android) and APNs (iOS) configuration, abstracting away most of the platform-specific complexity. However, several common issues trip up developers.