Take-home deployment for non-technical workshop participants

TL;DR — Decision for a 2026 workshop facilitator. Default to Bolt.new + Bolt Cloud for the workshop deploy (1M tokens/month free, no card, instant *.bolt.host URL, persistent DB bundled) [4] [5] [60]. Use Lovable if participants will iterate on phones (only platform with a polished mobile app in May 2026) [41] — but pre-warn them about the 5-daily / 30-monthly credit ceiling [44]. Avoid Replit free for take-home — its 5-minute sleep + 10–30s cold start makes the “show grandma” URL look broken [8]. The deploy click is solved everywhere; the actual failure point is the 7-day Supabase pause [27], and credentials baked into the bundle [61] — design the take-home card around those, not around the publish flow.

What “take-home deployment” actually means in 2026

Three distinct moments, each with different failure modes:

1. End of session — the URL exists. Every major vibe-coding platform now ships a one-click Publish to a free auto-subdomain with HTTPS [5] [15] [16] [18]. Solved problem.
2. Two weeks later — friends and family open the link. This is where free-tier sleep, Supabase 7-day pause, and authorization-inverted apps break things [27] [68] [8].
3. Two months later — the participant wants to add a feature. Credit caps, expired OAuth tokens, dead refresh tokens, App Store review delays [44] [63] [66] [49].

The platform you pick at the workshop is really a bet on 2 and 3, not 1.

Platform matrix — what survives the take-home test

Reading the matrix. Pick Bolt / Lovable / v0 if the workshop pitch is “ship from a prompt” and the participant won’t open a terminal. Pick Vercel / Netlify / Cloudflare Pages if a more experienced participant just wants their static site hosted — but you’ve already lost the “no CLI” promise. Avoid Render, Railway, and Fly.io for take-home: cold starts and forced credit cards kill the demo before friends ever see it [31] [33] [34].

Will it still work in 6 weeks? The “show grandma” test

The biggest invisible take-home risk isn’t compute — it’s the database. Vercel Hobby has no inactivity suspension and unlimited deployment retention [29]; Netlify only suspends if you blow the bandwidth quota, never on dormancy [39]; Cloudflare Workers are structurally immune because V8 isolates start in under 5ms [35]. Compute on those is fine for years.

But the database that the app depends on is where workshop apps die quietly. The single most important fact for any facilitator:

Supabase Free pauses projects after 7 days of database inactivity [27]. Dashboard visits don’t count — only real DB queries reset the timer [52]. Data survives the pause [53], but the resume is at minimum ~30s and at worst stuck for over an hour with the unpause button failing entirely [54] [55] (supabase/supabase ⭐ 103k).

A community ecosystem of cron pingers exists only to defeat this single behavior — travisvn/supabase-pause-prevention ⭐ 170 [28] is the canonical example.

Database options ranked by “left alone for two months”

Practical recommendation for the workshop’s default stack: if you need a real DB during the session, use Neon (transparent scale-to-zero, no manual unpause) or Turso (no pause at all). If you must use Supabase because that’s what the vibe-coding tool wires up by default, design the take-home card so participants know to manually resume the project after long gaps [53].

Ephemeral filesystem — the silent data-loss trap

Vercel officially states SQLite cannot be used with their platform because each serverless function instance gets its own ephemeral filesystem [56]. Replit explicitly warns that writes to a deployed Repl’s local filesystem disappear on any following redeploy [58]. Both AI assistants happily generate SQLite-backed code when prompted naively — so the workshop’s “Save my todos” app silently loses every entry the moment the participant edits the code and redeploys. Force the AI to use a managed DB (Bolt Cloud, Lovable Cloud, Neon, Turso) in the system prompt or initial-message scaffolding.

Auth and credentials — the dead-link of week three

The most-cited failure pattern across 2026 writeups isn’t the app crashing — it’s auth quietly returning 401 [68]. Concrete take-home killers:

• Google OAuth refresh tokens expire after 7 days while the consent screen is in Testing mode, and after ~6 months of non-use even once published [66]. Workshop apps almost always ship in Testing mode → guaranteed silent death by day 8.
• Clerk ships separate dev/prod keys; a common deploy failure is forgetting to swap, with no obvious error surface for a non-technical user [65]. Free tier now covers 50,000 MAU so there’s no cost cliff [64].
• Anthropic banned subscription OAuth tokens in third-party tools on April 4, 2026 — every app that embedded a Claude subscription token instantly broke and required migration to pay-as-you-go [63]. Treat any LLM-key the AI bakes into the app as a future fault.
• Lovable apps routinely embed Stripe/OpenAI/SendGrid keys in the JavaScript bundle, where credential harvesters find them within hours [61]. In March 2026 a single vibe-coded app leaked 1.5M API keys [62]. Workshop policy: no real keys in workshop apps — use the platform’s bundled cloud or test/throwaway keys only.
• Authorization is often inverted in laymen-built apps: a study of 170 Lovable apps found anonymous visitors with full access and logged-in users blocked [68]. The take-home app frequently looks fine on the participant’s own login but breaks for the friend they share it with.

The cleanest mitigation is the bundled-cloud route: Lovable Cloud ships DB, auth, storage, and AI auto-provisioned per workspace with $25/month free cloud credit and $1 AI credit; projects auto-pause when credits empty (rather than going broken) [59]. Bolt Cloud offers the same bundle with native auth (signups, logins, password resets, RBAC) baked in [60]. Either removes both the SQLite trap and the API-key-leak problem in one decision.

Custom domain — only worth it for the rare “I want this to look real” participant

Every platform’s auto-subdomain (e.g. gleaming-cobbler-3a8f.lovable.app) is functional and persistent [15]. Most workshop apps never need more — friends and family share via direct link or QR code. The fraction of participants who want a real domain split into three paths:

For the rare participant who wants a real .com, point them at Cloudflare Registrar at $10.44/yr wholesale (no markup, free WHOIS privacy, free DNSSEC — but locks the domain to Cloudflare nameservers) [22] or Porkbun at ~$10.91/yr with flat renewal pricing [23]. Avoid registrars that show $5.98 first-year teasers — Namecheap renewal jumps to $18.48 [23].

Two months later — can they actually iterate?

The “I forgot how to log back in” problem is essentially solved: every major tool accepts Google, GitHub, or email and shows every project on a default dashboard after sign-in [42]. What bites instead is how many follow-up edits a free plan permits:

Version-history is the other concern, and the news is good: Lovable’s Versioning 2.0 groups edits by date with bookmarks for milestones, restoring an older version creates a new edit card (non-destructive) [43]. Bolt preserves the live Bolt/Supabase DB when restoring earlier code [45]. v0 remembers conversation context across sessions so iteration builds on prior state [46].

Mobile iteration shipped in 2026. Lovable launched an iOS/Android app on April 27, 2026 that syncs between phone and desktop seamlessly [40] [41]. Replit Mobile Apps lets users build native iOS apps via Agent with QR-code Expo previews [48] — though Replit’s iPhone app went four months without updates in early 2026 due to an App Store review dispute [49], a real take-home fragility.

Replit also offers automatic redeploys on every Git push from the Version Control tab [50], removing the “where is the redeploy button” question entirely.

Designing the take-home card

Educators running 2025–2026 AI-coding workshops converge on a small set of patterns. The Berkeley ALS team explicitly committed to a series of follow-up workshops after one session because participants can’t keep pace with tool churn alone [70]. Anthropic’s Teach For All codifies the standard alumni stack: monthly office hours plus Claude Connect peer hub across 60+ countries for daily Q&A [73]. Lovable’s community is the template most platforms now copy: a 160K-member Discord, recurring topical office hours (e.g. Security Office Hours), and a community@ email [69]. In-person workshop afterlife often spans Meetup + a hub site + LinkedIn rather than a single channel [74] — so the card should list multiple re-entry points, not one.

Recommended content for a physical take-home card (synthesized from failure-mode writeups and platform docs; no canonical published template exists [71] [72]):

1. Your URL — printed verbatim, plus a QR code [5].
2. How you signed in — “Sign in with Google, the address ending in …” (handles the “wrong account at home” failure) [42].
3. If it says ‘paused’ or ‘unavailable’ → log into the platform dashboard and click resume; data is safe [53].
4. If a friend says it’s broken but it works for you → most likely an auth or authorization bug; ask the AI: “anonymous users can see everything but logged-in users get nothing, fix it” [68].
5. Daily edit budget — “you have X edits per day on the free plan” so they don’t burn the month in a single afternoon [44] [47].
6. Throw-away permission — the “permission to abandon” reframing reduces the pull on facilitator time when the prototype turns out wrong [72].
7. Re-entry URLs — Discord, Meetup, office-hours schedule, facilitator email [69] [73] [74].
8. One sentence on security — “don’t put real API keys, passwords, or credit-card details into your app” [61] [62].

The single most-reported pain point during the workshop itself is debugging — and the proven mitigation is teaching the participant to query the AI to explain errors rather than touch the code [67]. Bake that into both the in-session script and the card.

Recommendation summary

The deploy click is solved. The take-home is about choosing a platform whose free-tier failure mode is benign — and writing a card that tells participants exactly what to do when the silent failures (Supabase pause, OAuth expiry, exhausted credits) inevitably happen.