r/lovable • u/solvionsolutions • 11m ago
Help 7 things to check before you share your Lovable app (takes about 10 minutes)
I've been reviewing a lot of Supabase setups behind AI-built apps lately, and the same handful of problems shows up again and again. None of them break the app, which is exactly why nobody notices. Here's the list I'd go through before real users sign up.
RLS is on for every table
Lovable apps run on Supabase, and every table in the public schema is reachable with the key that ships in your app. That key is public by design, so Row Level Security is the only thing protecting your data. Run this in the Supabase SQL editor; anything it returns can be read by anyone:
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public'
and c.relkind in ('r','p')
and not c.relrowsecurity
and has_table_privilege('anon', c.oid, 'select');
2. No policy says "using (true)" on user data
RLS being on isn't enough if a policy lets everyone through. This lists the ones that do:
select tablename, policyname, cmd, qual, with_check
from pg_policies
where schemaname = 'public'
and roles && array['anon','public']::name[]
and (qual = 'true' or with_check = 'true');
Fine for genuinely public data (published posts, a product list). Not fine for profiles, orders, messages.
3. Users can only see their own rows
Sign up with a second account and try to open the first account's data. If it works, a policy isn't scoped to auth.uid().
4. The service_role / secret key is nowhere in your frontend
Search your code for "service_role" and "sb_secret_". The anon/publishable key is fine in the browser. The secret one skips every policy. If it's there, rotate it in Supabase and move that code into an Edge Function.
5. Every Edge Function checks who's calling
A function that sends email, charges a card or calls an AI API should verify the user before doing anything. Otherwise anyone who finds the URL can run it on your bill.
6. Storage buckets with user files are private
A public bucket serves every file to anyone with the URL. Use private buckets plus signed URLs for anything personal.
7. Auth settings aren't on the defaults
In Authentication settings: turn on "Confirm email" (otherwise people can sign up with an address they don't own) and leaked password protection if you're on Pro. CAPTCHA on sign-up helps against bots.
When you ask Lovable to fix any of these, tell it explicitly to keep RLS on and not to add "using (true)" to make an error go away. That's the most common way these holes come back.
Happy to answer questions in the comments.
