Your Lovable app works in the demo and breaks with real users. Here's what to do.
Sample before and after: one customer reading another customer's rows, illustrative
Before
- Customer A signs in
- App queries invoices
- No row-level policy
- Returns A's and B's invoices
After
- Customer A signs in
- App queries invoices
- Policy: own rows only
- Returns A's invoices only
Symptoms you might be seeing
- Users report seeing data that isn't theirs, or you're not sure they can't
- Payments succeed in Stripe but the app doesn't update, or the other way round
- Every new feature you generate breaks an old one
- The app slows down or errors once more than a handful of people use it
- You've been told your keys are exposed and don't know how bad that is
- You want to move off Lovable's hosting but don't know what would break
Why this happens with Lovable builds
Lovable generates a React front end with a Supabase backend, and it does that well. What it can't do is decide your security model for you. Row-level security policies are often absent or permissive because the demo worked without them. Environment separation, migrations, tests and monitoring aren't part of a prompt, so they don't get built. The result is an app that behaves in a demo and has no protection when real people, money and data arrive. This is not a criticism of Lovable; it is what a prototype tool is for.
What we do
- Two-day triage ($349): a senior engineer reads the repository and Supabase project and returns the five risks that matter most, an indicative fix range, and a fix-or-rebuild recommendation.
- Stabilisation (from $2,500, one to two weeks) or production hardening (from $6,000, three to five weeks): row-level security on every table, keys moved server-side, migrations and backups, tests around money and sign-up, CI with rollback, error tracking and cost caps.
- Keep building in Lovable if you want to; we harden the foundation, and GitHub sync keeps both in step. When you outgrow it, we migrate the code to hosting and a repository you control, without a rebuild.
- Optional managed engineering from $1,500 a month so it stays fixed.
FAQ
Do I have to stop using Lovable?
No. Most clients keep generating features in Lovable after we harden the app. We set up the guardrails that make that safe.
Can you just tell me if my keys are exposed?
That's part of the triage. Two days, $349, and you'll know everything that matters, not only that.
How much will the fix cost?
Stabilisation from $2,500, full hardening from $6,000. The triage gives you a range for your app specifically.
Will you need my Supabase and Lovable logins?
We need read access to the repository and a role in the Supabase project. We never ask for your personal credentials, and access is revoked at handover.
Is my code safe with you?
Yes. Named access only, NDA on request, nothing reused or trained on.
Do you work with Supabase specifically?
Yes. Most Lovable apps run on Supabase, so row-level security, edge functions, migrations and backups are where we spend most of our time. We work inside your existing Supabase project, put every policy and schema change under version control, and hand back a project you can keep building on in Lovable.
What if the triage finds nothing serious?
Then we say so. If the triage finds nothing that blocks launch, the triage is free. If it finds blockers and you go ahead, half of the $349 is credited against the sprint that follows within 30 days.
Tell us what's breaking, or what's slow.
We take on a limited number of engagements at a time and reply to every message, including the ones we're not the right fit for.