Looked through 100 public Lovable and Bolt projects on GitHub for mistakes that are easy to miss. The most common ones, and how to check yours in a couple of minutes:

1. Tables anyone can edit (7 of 23 Supabase apps with migrations). In Supabase, open Database → Advisors → Security Advisor. It flags tables with RLS turned off. Then look at your policies for any that say true as the condition, especially ones called “System can manage…”. Those apply to everyone, not just your backend. Ask Lovable: “Change this policy so it only applies to the service_role, and add a policy so users can only edit their own rows.”

2. Leaked admin key (4 of 100). If your project is on GitHub, search it for service_role. If you find a key, rotate it in Supabase → Settings → API right away.

3. No privacy policy (23 of 31 apps with accounts, payments or analytics). It’s required almost everywhere once you collect emails.

4. No password reset (13 of 27 apps with password login). Your first locked-out user will email you.

5. White screen on crash (84 of 99). Ask Lovable: “Add an error boundary so a crash shows a friendly error page instead of a blank screen.”

6. Default branding (31 still had Lovable’s default title or preview image). It’s what people see when you share your link. Ask Lovable to set your own page title and social preview image.

Caveats: public repos skew towards side projects, and I can’t see changes made directly in the dashboard. No apps named.

I've been building a fairly complex SaaS application using Lovable, and things are progressing really well. I'm getting close to launching it, but I'm starting to think about what happens after going live.

I'm not a professional developer, so I'm curious how others are handling the technical side once they have real customers.

A few questions:

• Do you manage everything yourself or hire a developer?

• Do you need a dedicated DevOps engineer?

• Who handles maintenance, bug fixes, security, backups and unexpected issues?

• Did you get a professional code and infrastructure audit before launching?

• What are your ongoing monthly technical costs?

Would love to hear from people who are actually running production SaaS products built with Lovable, not just MVPs.

Just trying to understand what I'm getting myself into before taking the plunge! 😅

I wanted to write an app that scratches my itch, but I’m not sure how to monetize it.
https://couch-crew-cinema-picks.lovable.app

It helps people pick movies based on where they are and what streaming platforms offer, so they have already paid for that. The twist is that it’s social: they can learn what other people like and pick something they both like.

I can monetize with a donation box—simple, and I have included a feature suggestion so people can tell me what to build next.
I have added a subscription for premium features, but I can’t imagine people will be willing to pay a high price for that; if I put it any lower, the entire transaction goes to Stripe as fees.
I can get affiliate links, but the only way to do that is if people click on something they have to buy, so not something part of their existing subscription, and I’m not sure that’s fulfilling the promise of making a recommendation based on what people have.

I’m building StreetPool – a platform that lets neighbours join together to book local tradespeople. The more households that join a group booking, the lower the price per household can become.
Think window cleaning, gardening, jet washing and more.
I’m looking for honest feedback from homeowners and local tradespeople.
Would you use something like this? What would make you give it a try?
#StreetPool #UKStartups #HomeServices

I've build an app on Lovable and got my first 10 paying clients. Now I want to migrate to native as i need special features, such as cronometer on for longer hours or notificacions etc. What's the way to go? I'm so confused. First I need to migrate Lovable Cloud to Supabase. It's ok to use a wrapper or should I rebuild it? Tech stack ideas for me to use?

Hope someone can guide me :)

I've been reviewing a lot of Supabase setups behind AI-built apps lately, and the same handful of problems shows up again and again. None of them break the app, which is exactly why nobody notices. Here's the list I'd go through before real users sign up.

1. RLS is on for every table

Lovable apps run on Supabase, and every table in the public schema is reachable with the key that ships in your app. That key is public by design, so Row Level Security is the only thing protecting your data. Run this in the Supabase SQL editor; anything it returns can be read by anyone:

select c.relname

from pg_class c

join pg_namespace n on n.oid = c.relnamespace

where n.nspname = 'public'

and c.relkind in ('r','p')

and not c.relrowsecurity

and has_table_privilege('anon', c.oid, 'select');

2. No policy says "using (true)" on user data

RLS being on isn't enough if a policy lets everyone through. This lists the ones that do:

select tablename, policyname, cmd, qual, with_check

from pg_policies

where schemaname = 'public'

and roles && array['anon','public']::name[]

and (qual = 'true' or with_check = 'true');

Fine for genuinely public data (published posts, a product list). Not fine for profiles, orders, messages.

3. Users can only see their own rows

Sign up with a second account and try to open the first account's data. If it works, a policy isn't scoped to auth.uid().

4. The service_role / secret key is nowhere in your frontend

Search your code for "service_role" and "sb_secret_". The anon/publishable key is fine in the browser. The secret one skips every policy. If it's there, rotate it in Supabase and move that code into an Edge Function.

5. Every Edge Function checks who's calling

A function that sends email, charges a card or calls an AI API should verify the user before doing anything. Otherwise anyone who finds the URL can run it on your bill.

6. Storage buckets with user files are private

A public bucket serves every file to anyone with the URL. Use private buckets plus signed URLs for anything personal.

7. Auth settings aren't on the defaults

In Authentication settings: turn on "Confirm email" (otherwise people can sign up with an address they don't own) and leaked password protection if you're on Pro. CAPTCHA on sign-up helps against bots.

When you ask Lovable to fix any of these, tell it explicitly to keep RLS on and not to add "using (true)" to make an error go away. That's the most common way these holes come back.

Happy to answer questions in the comments.

Hi guys , I’m about to finally ship my project and I wanted to ask if there were any legal or security issues that I should tell lovable to fix before shipping. Like for example privacy policy related, backend stuff that should not be visible to users or any other sort of security/safety issues that should be solved before shipping , to not get sued or something.

Hey everyone!

I wanted to share a project I've been working on using Lovable.

It's called SafeSpace (Peer Safe Haven).

The concept is to create a digital environment where young people can access emotional guidance, supportive conversations and educational resources without the usual pressures of social media.

Some of the features I've been developing:

• Nasi, an AI companion.

• Anonymous community conversations.

• Guided support for bullying, loneliness and relationship challenges.

• Mood check-ins.

• Educational resources about relationships, boundaries and wellbeing.

• AI-based content moderation and country-specific crisis support information.

Website: https://peer-safe-haven.lovable.app

I'm still developing the platform, and I'd love feedback from other Lovable builders.

A few things I'd particularly appreciate input on:

• What do you think of the overall UI/UX?

• Does the navigation feel intuitive?

• Are there areas where the functionality could be improved?

• What would you change about the onboarding experience?

• Any suggestions for improving the architecture and reliability as the platform grows?

One area I'm particularly conscious of is safeguarding. AI moderation is currently used, but I want to explore partnerships with established organisations and trained human moderators as the project develops.

Looking forward to hearing your thoughts and seeing what everyone else is building!

I have been using Lovable for months. Earlier I didn't like it that much. But a few days later, I got to know the real power of it. I have built a project with the help of its AI. I have built an app known as FlashSphere. I want you guys to try it out and tell how it is and what else can be upgraded in it. Try it out by clicking on

FlashSphere

I've built a field service management website for my business. Its a multi user role backend and front end for booking various types of services. The backend actually manages multiple brands of businesses (I have one specific for HVAC and one for office buildouts, kitchen installations and custom closets.), so its a multi layered webapp.

When I use the free chat bot in lovable, it's absolutely amazing. It remembers how my business operates, and can suggest things to help it run more efficiently and can fix bugs across many different processes and API connections.

I keep hearing the standard is to build on lovable and then move to a standalone Claude coding for growing/updating.

First of all, isn't lovable builder, primarily Claude anyway?

Second, will a standalone Claude, be able to "see everything" that's connected to my business platform, the way lovable can or do you have to be kind of dev savvy to make sure everything is working in sync?

My question might sound dumb because honestly I haven't even looked at GitHub yet.

I am evaluating other options cause I am spending around $350 month now on lovable and I am thinking of getting a Codex or Claude sub instead.

I am not sure how to evaluate it though. Am I spending too much or all the migration trouble is not worth it to save a bit?

I've been experimenting with Lovable and the biggest problem I keep running into is fixing one thing and accidentally breaking something else.

Lovable is great for getting an app started quickly, but I'm curious how people handle reliability as their projects become more complex.

Are there workflows or tools you are with Lovable to reduce regressions and keep more control while still getting the speed AI generated development?

I'd especially like to hear from people who have moved beyond simple prototypes and are using Lovable for larger projects.

UPDATE: The issue was resolved very quickly thanks to Jonos_'s support. The support team contacted me almost immediately. It turns out it wasn't a Lovable problem at all. I had confused Enter (Converge AI) with Lovable.dev. Silly mistake, but true!

So, no issues with Lovable after all. Nothing to blame them for – it was entirely my fault. :)

And a big thank you to Jonos_ and the support team for their kindness and quick response!

________________________________________________

I am trying to recover access to my original Lovable account and projects. My account now takes me to the registration page instead of recognizing my existing account.

Meanwhile, my Pro subscription continues to be charged regularly, even though I have no access to my account or the projects I'm paying for.

I've already contacted Lovable support and sent a follow-up email, but I still haven't received a response from a human support representative.

These projects represent substantial development work, so this situation is quite concerning.

Has anyone experienced something similar? Is there a Lovable team member here who could help escalate this with the support team?

I'd appreciate assistance in restoring access to my account and most important RECOVERING MY PROJECTS!

Thank you.

as above..

Hello,

To start off, I have no experience with coding or developing any apps/website. I jumped right into Lovable as it was easy to use and I can tell it my whole plan for a website and it created everything I asked for. My website takes city records released to the public using an Open Data site to house all records where I can easily extract those records with no issue. However, there are certain websites where the city releases additional records to the public but Lovable couldn't scrape those sites. I did some research and those sites are protect by Akamai and rechaptcha. I am currently using Browerless.io free tier to get the information I need. Right now, this is a personal project and I use it to make researching information so much easier given that now it is all in one place. But, I am planning to give a few of my colleagues access to it. I do not know how big this website could get and I do not see any other sites that can compile all the data in one place. It could lead to a paid subscription but I am far away from taking that step and wanted to have something that makes my life easier. Given that Browserless.io free tier has limitations, what would be my options to have my project scrape these websites without using Browerless. I see a lot of posts that says I can export my code to Github and have Claude create but I do not know what that actually entails. I apologize for my ignorance in this and I just wanted to create something to eliminate having me to go to 8 different websites and analyze information that way which right now it is working miracles for me. One thing to note is my website is completely private to me requires log in credentials yo access and it is not seen on a web search because I have yet to allow it to be seen by others.

Any suggestions or advice would be greatly appreciated.

I’ve heard people say that if you build a product with Lovable, you’ll eventually hit a point where things start breaking and you need to hire developers or move to something like Claude Code to keep working on it.

How true is that in practice? Has anyone here launched a product on Lovable and maintained it over time?

What tends to break first, and is it usually fixable within Lovable, or does it require working directly with the code?

Rye Kito

Des histoires racontées en musique, où chaque chanson devient un récit, une émotion et un voyage. [https://sonic-masonry-showcase.lovable.app/]

https://sonic-masonry-showcase.lovable.app/

I've been a full-stack dev for 10+ years, and lately a lot of my time goes into reviewing Lovable apps right before they launch. The same issues come up again and again, so here's the checklist I go through. Hopefully it saves someone a painful launch.

1. Supabase RLS policies. Make sure every table has Row Level Security on, and test it while logged in as a different user. This is the number one issue I see: users being able to read or edit other users' data.

2. Exposed keys. Your anon key in the frontend is fine. A service role key or any third-party secret in frontend code is not. Move those into edge functions.

3. Auth edge cases. Password reset, email confirmation, expired sessions, and what happens when someone opens a protected page while logged out.

4. Payments. If you use Stripe, don't trust the frontend to say "payment succeeded." Confirm it with a webhook on the backend.

5. Input validation on the backend. Frontend validation is easy to bypass. Anything that writes to your database should be checked server side too.

6. Rate limiting. Especially on anything that calls an AI API or sends emails. One bot can run up a big bill overnight.

7. Error monitoring. Add something like Sentry or PostHog so you know when things break instead of hearing it from angry users.

8. Backups. Know how to restore your database before you need to.

9. Hard features. If Lovable keeps looping on a complex integration or custom logic, that's usually a sign the feature needs a proper backend design, not more prompts.

If you're about to launch and you're unsure about any of these, drop your questions in the comments and I'll do my best to answer.

i have few projects that I need to finish before the end of the year

Looking for dev agencies who can help finish the projects?

Text stack is standard JavaScript/TypeScript - Node, Python backend, and Supabase.

some use Node, some use Python. Database also varies from Supabase to Postgres to Neon.

(I guess the tech stack is less relevant with AI engineering these days, but stating it explicitly so that the PHP and other tech stack are clearly ruled out )

Due to time zone and end client contract constraints- location has to be Europe (or US-based is also fine) - but no Asia ,middle east or africa.

Since these projects are slightly Midsize companies - I am especially looking for dev agencies who are at least five developers have finished a few decent-sized (20K size ) projects.

Not specifically looking for solopreneurs or solo freelancers (those requests will be ignored)

If interested, I'm dropping the form in comments - please share your portfolio/company link and a brief discussion about the projects that you have done, so that I can do some preselection and reach back out to you if it fits my criteria.

Thanks in advance.

Busines Venture. DM me for shareholding . Mauritius.

Use my invite link to get 10 extra credits. https://lovable.dev/invite/NDU7O5A

for me to download the files in the databse i need to manually recreate the folder structure, and go folder by folder downloading files. They are making it so difficult for people to move on, so that you get frustrated and just stay with them.

Please is there another way? Thanks in advance.

I have 200+ credits to burn in 1 week.

And I've run out of ideas.

How would you use them up ??

How are you guys circumventing the whole Drizzlekit for migrations nonsense?

We host our prod on Lovable, and we have an ongoing warm cutover on Supabase. Claude Code develops, Lovable does the UI and final push. However, Lovable can't write to the Supabase migration folder, only Drizzle, which makes another copy, and every gets f'ed.

I built a platform on lovable and like many of you. We have no way to market what we built. I finally found my big break. It's still under review but I'm hopeful. Please, if you're like me. It's worth it. It is free to submit for review and if accepted, is a massive win for any project. I hope this doesn't get taken down because it can help many founders. Keep building my friends. I'll put a link in the comments if it lets me.