AI coding tools make it easy to spin up a prototype in an afternoon. They also make it easy to spin up three more the following week when the first one did not quite work. Each one creates hosting resources, database projects, API keys, and sometimes open endpoints - and most of them are never formally decommissioned. They just stop being the thing you are working on.
This post is a practical checklist for founders and solo builders who have accumulated prototypes and are not sure what is still running, what it is costing, and what it is exposing.
What an Abandoned Prototype Leaves Behind
When you stop working on a Vercel + Supabase prototype, several things continue to exist:
- A live Vercel deployment, accessible at its auto-generated URL, serving whatever code you last pushed
- A Supabase project with a live database and an active anon key
- Any API routes in the deployment that accept requests
- Any cron jobs configured to fire on a schedule (on Hobby, Vercel cron jobs are limited to once per day)
- Any storage buckets that may have files in them
- Any webhooks registered to third-party services that point at the deployment
Vercel's Deployment Protection can restrict who reaches your URLs, but under Standard Protection production domains stay publicly accessible, and that is what a forgotten prototype usually has. If you built any API routes - including the ones AI tools generate automatically for form submissions, user sign-ups, or data fetching - those routes are still accepting requests from anyone who knows or guesses the URL.
The Supabase Free Tier Problem
Supabase pauses Free Plan projects that show low activity over a 7-day period. A paused project stops serving requests, and per Supabase you can restore it for up to one year after it was paused, returning to its previous state including data. You have to take an action to resume it, so you may not notice the pause until you try to access something. The policy has changed before, so check the current page.
More relevantly: Supabase judges activity by database queries, so a forgotten cron job, a crawler or a webhook that keeps querying the project may stop it counting as low-activity. An 'abandoned' project is not necessarily idle if something is still hitting it.
The anon key for that project - the public API key that Supabase generates and that AI tools routinely embed in the frontend code - is still valid. If you never set up Row Level Security properly on that prototype (and many AI-generated schemas do not have it correctly set up, as we documented in our Supabase RLS post), anyone with the anon key can query your tables.
Hidden Costs of Running Prototypes
The Vercel Hobby plan is free and has no billing cycle; if you exceed its usage limits you generally have to wait 30 days before you can use the feature again, rather than being charged. Hobby is also restricted to non-commercial, personal use. So an abandoned prototype may cost you nothing on Vercel. It costs you in other ways: it is a live attack surface, it is an accountability gap, and if it uses any paid third-party service, those charges continue.
Common paid services that prototypes accumulate:
- Supabase Pro plan (if you upgraded during development and forgot to downgrade or delete)
- OpenAI or Anthropic API keys that are still valid and embedded in the prototype
- Stripe in test mode (free) but with real webhooks pointing at the prototype URL
- SendGrid, Postmark, or Resend for email (credits used by forgotten scheduled emails or sign-up flows)
- A domain name that auto-renews annually
The AI API key risk is the most serious. If your prototype embeds an OpenAI key in the frontend (a common pattern in AI-tool-generated code where the key goes into a client-side environment variable), that key is visible to anyone who looks at the page source or network requests. It can be used by others at your expense. Check your OpenAI usage dashboard for any spikes that do not correspond to your own work.
The Open Endpoint Risk
AI-generated prototypes commonly create API routes without authentication. A route like `/api/send-email`, `/api/create-user`, or `/api/submit-form` that accepts a POST request and does something without checking who is calling it is open to anyone. On an abandoned prototype, this may include:
- A form submission endpoint that can be used to send emails through your account
- A user creation endpoint that can generate accounts in your database
- An AI completion endpoint that routes requests to your AI API key
- A webhook endpoint that processes incoming data without validating the source
If your prototype's URL has been shared or indexed anywhere, assume someone can find it. The security risk of an abandoned open endpoint is not theoretical.
The Cleanup Checklist
Work through this for each prototype you have not actively used in the past 60 days:
- Vercel: Go to your project settings and delete the project. Deleting a project also deletes its deployments, domains and environment variables, so archive the GitHub repo first if you want to keep the code.
- Supabase: Delete the project in the Supabase dashboard. Confirm deletion - Supabase says deleting a project removes its data and backups irreversibly.
- API keys: Revoke any API keys that were used in the prototype. Do not just delete the project; revoke the keys so they cannot be used even if someone has them cached.
- Third-party services: Check Stripe, SendGrid, Twilio, or any other service for webhooks pointing at the prototype URL. Delete them.
- Domain names: If you registered a domain for the prototype, decide whether to keep it or let it expire. If keeping it, point it at a parked page, not at the prototype.
- GitHub/GitLab repos: Archive rather than delete so you have the code if you need it, but make it clear the project is not active.
- Environment variables: Check your CI/CD environment variable store for any secrets that were specific to the prototype. Remove them.
Before You Build the Next Prototype
A short-lived prototype deserves a short-lived infrastructure plan. Before you spin up Supabase and Vercel for the next experiment, consider: a local SQLite database for the prototype phase, environment variables that are never committed, and a named cleanup date in your task list. If the prototype does not graduate to a real project by that date, the cleanup should be automatic.
The AI tools that generate your prototype do not generate a decommissioning plan. That gap is worth thinking about before you create the next one rather than after.
If you have a prototype that has grown into something more serious - users are using it, data is in it, and you are not sure what you have inherited from the AI-generated scaffolding - run the free app health check for a baseline. If the results surface things you are not sure how to fix, we can review the app and give you a clear action list. See also our post on code and account ownership for what to document before handing off or sunsetting a project.
Common questions
Do abandoned Vercel and Supabase prototypes still cost money?
An abandoned prototype may cost nothing on Vercel, since the Hobby plan is free and has no billing cycle. The costs come elsewhere: it stays a live attack surface, and any paid third-party service it uses, such as an AI API key or a Supabase Pro plan, keeps charging.
What happens to a Supabase project on the free plan when you stop using it?
Supabase pauses Free Plan projects that show low activity over a 7-day period. Per Supabase, you can restore a paused project for up to one year, returning to its previous state including data. The policy has changed before, so check the current page.
Should I delete an old AI prototype or just leave it alone?
Delete it. Remove the Vercel and Supabase projects, revoke any API keys used in it, and delete webhooks pointing at its URL. Left live, it keeps open endpoints and valid keys exposed. If unsure what a prototype exposes, run the free app health check; Zovintra can also review the app and give you a clear action list.
Sources
- Project Pausing - Supabase Docs, accessed 19 Oct 2026
- Deployment Protection - Vercel Docs, updated 15 Sep 2026
- Vercel Hobby Plan - Vercel Docs, updated 14 Sep 2026
- Usage & Pricing for Cron Jobs - Vercel Docs, updated 15 Jul 2026
- Managing projects - Vercel Docs, updated 11 Aug 2026
- Database Backups - Supabase Docs, accessed 19 Oct 2026
