Lovable security checklist
Lovable builds a React app that usually stores its data, sign-ins and files in Supabase, and talks to it straight from the browser. That is fast and fine, as long as the database itself decides who may see what.
These are the checks we see AI-built Lovable apps miss most. Each links to a four-minute scenario showing the failure, and the prompt that finds it in your own project.
Tables anyone can read
With Row Level Security off or missing a policy, anyone with your public key can download every row.
Other users' records by changing an id
Signed in is not the same as allowed: every query must be limited to the current user.
Secret keys in the browser code
A paid API key added to make a feature work can end up in the code every visitor downloads.
Uploaded files open to the world
A public storage bucket serves every file to anyone with the link pattern.
Admin pages protected only by a hidden button
Hiding a button in the page does nothing: the action itself must check who is asking.
Prices decided in the browser
Anything the browser sends can be changed, including what a plan costs.
Sign-up emails that point at localhost
Auth redirect settings left on the preview address send real users nowhere.
Confirmation emails that stop at launch
Built-in auth email has low sending limits; launch day finds them.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.