Guides

The problems we actually find, explained for someone who didn’t write the code. Each one covers what causes it, how to check your own app in a couple of minutes, and the exact fix.

• Why Lovable apps ship with the database open

  Row Level Security is off while you build because it has to be, and nothing ever turns it back on. The mechanism, a 30-second self-check, and the exact fix.

  5 min read

• Which Supabase keys are safe in the browser

  The anon key is meant to be public. The service_role key ends your security model. How to tell them apart in ten seconds, and what to do if the wrong one shipped.

  6 min read

• An API key leaked into your app. What to do in the next ten minutes

  Deleting the key from your code does nothing on its own — the old build is still out there and the key still works. The order of operations that actually closes it.

  6 min read

• Is my AI-built app safe to publish? A checklist you can run yourself

  Seven things to check before you put a live URL in front of real users, in the order that matters. No tools required, though we'll check them for you if you'd rather.

  8 min read