Across the last 12 months, the next most common patterns are production settings that differ from a laptop (17%), slow paths and hard quotas (13%), and a changed dependency (13%).
753 in the last 12 weeks · about 63 a week
Share of the 937 recent verified cases
57 new verified cases in the last 28 days, up from 39 in the 28 days before.
A release shows green or is half-finished while production serves something else. The live site runs a months-old build, a rollout kills a call in progress, an unpinned CLI jumps a major version, or the site renders blank after a host or runtime change. Several reports say nobody noticed for days.
A variable reaches the app locally but not when deployed. A key is rejected after a rotation. A CORS allowlist omits a real origin, or login redirects to localhost. A domain's certificate is wrong, a record is missing or the redirect returns 200 instead of 301. The failure is specific and never shows up in development.
A search times out because an unindexed count runs before every query. The first request after idle returns 500. A free-tier quota for CPU, egress, commands or build minutes runs out. A slow model call outlives the function limit. Queued retries pile up behind a stalled worker.
A model name is retired and the gateway returns 403 or 404. An upstream API starts challenging requests with a Cloudflare 403. A provider changes its access rules and every request is unauthorized. A weather, geocoding or map-data service goes down with no fallback. An AI provider account runs out of credit and the alerts are ignored.
New code reads a column before its migration has run. A migration passes staging and fails on production data. A blocking index build takes a tenant down at startup. Two refreshes delete each other's rows. A retry duplicates an entire client book. A pooled connection is held across a slow call and dropped. The API falls back to an in-memory store while health checks stay green.
The first login after idle fails. Sign-up ends on a 404. Users are logged out whenever the app process is killed. A mail scanner consumes a sign-in link before anyone clicks it. CORS preflight blocks an iOS app, or an expired token leaves an account shown as connected while every request fails.
Tables are open to anonymous and authenticated roles. A public search returns the names of private pages. A public function runs with a privileged client. Admin rights go to every user of an email domain. A share endpoint will send branded mail to any address. Auth routes are rate-limited by a header an attacker can forge.
A disabled webhook leaves paid orders pending with no confirmation email. A buyer lands on the pricing page after checkout. A balance still shows after a successful payoff. A subscription change fails because the price currency does not match. A paid fulfillment dies on a type mismatch and needs manual recovery.
Every one of the 937 cases is counted once: 785 in the patterns above, 152 fit none of them yet.
Public posts from the sources below, fetched politely, newest first.
Claude judges each against one fixed definition, quoting the post.
Kept only if that quote is found verbatim in the stored post.
The window every number on this page uses.
Grouped into failure patterns; only aggregates are published.
We search public forums (Stack Overflow, GitHub issues, Hacker News and vendor community forums) with the same number of queries for each of 12 stages of going live, from deploys and configuration to sign-in, payments, data, performance, AI APIs, email, domains and abuse, so no area is over-sampled by how we search.
Each post is judged by a model given one fixed definition (a first-person report of the author's own app failing in production or at launch) and a fixed list of categories. It is not told who publishes this report. A verdict counts only if it comes with a quote that we find word for word in the stored post.
For every case we keep the post as fetched, its hash, the fetch time and a copy of the page (985 of 1103 also in the Internet Archive), so any number here can be traced to its sources even if a post is later edited or deleted. We publish only aggregates: no names, handles or quotes.
Limits: English-language public forums only, and people who post about a failure are not a random sample of all apps. Counts can overlap between patterns. Gemmein publishes this report and sells a backend; the collection and judging above are blind to that, and each pattern says plainly when Gemmein has nothing to do with it.
Every day a sample of already-judged posts, spread evenly across sources and across "case" and "not a case" verdicts, is judged a second time by a reader that is never shown the first verdict. Where the two disagree, a third pass looks at the post and our stored copy of the page and settles it; the case is then kept, corrected or excluded.
800 posts re-checked since 2026-10-07; the two readers agreed on 82.5% (last 30 days: 83.0% of 700). 63 correction(s) so far: 35 verdict, 25 category, 3 duplicate. Identical cross-posts count once. Of the re-checked posts, 18 had since been removed or moved (2 of them backed by our stored copy).
Source mix of the counted cases: github 64%, stackoverflow 11%, vercel forum 8%, netlify forum 6%, fly forum 5%, hackernews 2%, bubble forum 2%, cursor forum 1%, freecodecamp forum 0%. One source is above 40%, so collection is being widened to other neutral forums. Guides are re-read against the current official documentation at least every 14 days (19 reviewed in the last 14); each shows its review date and what changed.