Is a Lovable app secure by default?

No. Lovable apps talk to Supabase straight from the browser, so Row Level Security policies are the only thing separating users' data. CVE-2025-48757 (May 2025) covered Lovable-generated apps that shipped with missing or wrong policies. Lovable's own security scan helps, but you still verify every table by hand.

How do I check Row Level Security on my Lovable app?

Log in as two different users. As user A, request user B's row by id through the Supabase REST API with the anon key. It must return nothing. Repeat for every table that has an owner column. Ten minutes, no code changes.

Can I move a Lovable app off Lovable?

Yes. Lovable syncs the full code to GitHub both ways. Clone the repo, run `npm run build`, and point it at a second Supabase project. If it builds and runs, you own the app; if it does not, you have found the first thing to fix.

What does making a Lovable app production-ready cost?

When the app already works, it is usually a fixed-scope hardening pass of one to two weeks. SystemTrails prices that from $2,500, quoted after a free recorded teardown.

Does Lovable back up my database?

Supabase does, on paid tiers: daily backups on Pro, Point in Time Recovery as an add-on. The free tier has none. Check the Supabase dashboard, not Lovable, and test a restore before launch.

Lovable app production checklist: eight checks before real users (2026)

A Lovable app is ready for real users when four things hold: every table has a Row Level Security policy you have tested with two accounts, the Supabase service_role key never reaches the browser, the migrations and a tested backup exist outside the Lovable editor, and the synced GitHub repo builds and runs on its own. The eight checks below are the same ones every AI builder needs; the platform-specific notes are what Lovable does differently.

If you want these checks run on your actual code, the free teardown does exactly that, recorded, within 72 hours.

What Lovable gives you

Frontend	React, Vite, Tailwind, shadcn/ui
Backend	Supabase Edge Functions
Auth	Supabase Auth
Database	Supabase Postgres
Hosting	Lovable hosting, or exported to Vercel, Netlify
Code export	Full GitHub sync, two-way
Docs	https://docs.lovable.dev

The eight checks

Authentication and session handling

Log in as two users in two browsers. Confirm a logged-out request to any data route gets 401, and tokens are not in localStorage or URLs.

Per-user data isolation

As user A, request user B's record by id through the API. It must fail. Repeat for every table that has an owner.

On Lovable: Lovable apps read and write Supabase directly from the browser with the anon key, so Row Level Security policies are the only thing separating one user's data from another's. CVE-2025-48757 (May 2025) covered exactly this class of failure. source (checked 2026-08-28)

Secrets out of the client bundle

Build the app and grep the output for service keys, API keys and database URLs. Anything found is public.

On Lovable: The Supabase anon key is meant to be public. The service_role key is not, and must never appear in the Vite bundle or in an Edge Function that the client can call without auth. source (checked 2026-08-28)

Database rules, migrations and backups

Find the migration files, run a restore from the last backup into a scratch project, and time it.

On Lovable: Lovable manages the Supabase schema through its own migration flow; confirm the SQL migrations exist in the synced GitHub repo and that Point in Time Recovery is enabled on the Supabase project (it is off on the free tier). source (checked 2026-08-28)

Payments and webhooks

Replay the same webhook event twice. The ledger must change once.

Errors, logs and alerts

Throw a deliberate error on a staging route. Someone must be paged, and the log must carry the user and request id.

Environments, deploys and rollback

Deploy a visible change to staging first, then production, then roll it back. Time each step.

Code ownership, export and the trail

Export the repository, build it outside the platform, and hand the architecture map to someone who has never seen it.

On Lovable: Two-way GitHub sync means the exported repo is the real thing. Build it locally with `npm run build` and run it against a second Supabase project to prove the app is not tied to the Lovable editor. source (checked 2026-08-28)

What has already gone wrong on Lovable

Date	Incident
2025-05	CVE-2025-48757: Lovable-generated apps shipped with missing or misconfigured Supabase Row Level Security, exposing user data