Built with Lovable
Is my Lovable app secure?
Lovable did its job. It built you a real app in weeks. The question is whether the access rules around it hold up. Lovable builds on Supabase, and the thing that decides who can read and change what is Supabase's row-level security, not the front end. So "is my Lovable app secure?" is really "are my Supabase rules right?" The checks below are the ones to run before real users, payments or investors depend on the app.
What Lovable generates under the hood
Lovable now builds on TanStack Start (full-stack React) with Tailwind and shadcn/ui, hosted on Cloudflare Workers, with server logic in TanStack Server Functions. It uses Supabase for the database, auth, storage and realtime. Apps created before 13 May 2026 still run the older React + Vite stack. The problems that usually turn up are specific to that stack, not to Lovable itself.
The problems that usually turn up
These are the things that usually turn up in Lovable apps, in plain English. Each one points to where to go deeper, the launch checklist and the guides, rather than restating them.
- Anyone can read every customer's data. If a table has no row-level security, or the rule is too broad, any logged-in user, or sometimes anyone, can read or change every row. (row-level security) The launch checklist, check 02.
- A stranger can use your most powerful key. The service-role key bypasses every rule. If it ended up in the client bundle, anyone who opens the app can read and write your whole database. (service-role key in the client) The launch checklist, check 01.
- The public key is being treated as the lock. The anon key is meant to be public. If the app's safety depends on keeping it secret, the data it guards is not safe. (anon key as a secret boundary) The launch checklist, check 01.
- A server function with no auth check. A route that does something on your behalf without checking who is asking. A stranger can trigger it, and it can cost you money or change data. For new Lovable apps this is a TanStack Server Function on Cloudflare Workers. Apps built before 13 May 2026 run Supabase Edge Functions with the same risk. (broken access control) The launch checklist, check 02.
These are a few of the common pitfalls, and there are many more. The full list is on the launch checklist.
The DIY checks
Work through these on your own. They are free, and there is nothing to sign up for.
- The launch checklist. The questions to ask your AI before you launch, each with what a good answer looks like.
- Is my AI-built app safe to launch?. The three things AI-built apps keep shipping with.
- I built it with Lovable, Bolt or Cursor. Does that matter?. Why the tool does not matter, and what does.
- How much does my app cost to run?. The cost drivers and the exploits that ramp the bill.
Which shakedown fits
The Quick Shakedown (from AUD 750) is the right fit for a Lovable app. It covers the exact things Lovable apps get wrong: exposed keys, open data, broken access. If you want the whole app reviewed rather than just the highest-risk parts, the Full Shakedown (from AUD 1,500) goes through everything and hands back the engineer-ready clean-up. If you are prepping for a launch or a raise, Launch-ready (from AUD 2,500) adds the written brief your first hire, or your AI, can work from. Every price is "from", quoted up front for the size of your app and fixed once agreed.
Want it done for you?
I can go through all of it with you
A shakedown is me asking every one of these questions, of your whole app, and handing back a ranked report with a fix your own AI can apply. Quoted up front for the size of your app, fixed once agreed.
Not sure which one? Book the free 30-minute call and I'll help you choose.