From Lovable prototype to production SaaS
Lovable · React · Supabase · Stripe
This is a demo project we use to show our process. It’s based on common issues in apps built with AI tools. It is not a client story.
The situation
A founder builds a booking app for local fitness studios using Lovable. In six weeks it has a polished interface, Stripe payments and a Supabase database. Three studios want to start using it next month.
Before inviting real customers, the founder wants to know: is this safe to launch?
What the audit found
In a 30-minute free audit, these were the top risks:
- The database was readable by anyone. Supabase’s Row Level Security (the rules that decide who can see which rows) was switched off on four tables, including the one holding customer names, emails and phone numbers. Anyone with the public URL could download all of it.
- A secret key was shipped to the browser. The Stripe secret key had been pasted into front-end code. Anyone could open their browser’s developer tools and copy it.
- One environment for everything. Testing happened against the live database, so a bad prompt could wipe real bookings.
- No backups, no alerts. If the database was deleted or the site went down, nobody would know until a customer complained.
What we did
- Locked down the data. Turned on Row Level Security for every table and wrote rules so each studio only sees its own bookings, and each customer only sees their own.
- Moved secrets server-side. Rotated the leaked Stripe key, and moved all payment logic into a server function so secret keys never reach the browser.
- Split staging and production. A separate test environment with its own database, so changes are tried safely before they go live.
- Added a safety net. Daily database backups with a tested restore, uptime monitoring, and error alerts sent straight to the founder’s phone.
- Wrote it down. A one-page plain-English summary of how the app is set up and what to check before each release.
The result
The app launched to its first three studios on schedule. The founder kept building with Lovable, and now changes go through staging first, with backups and alerts already in place.
Built something similar? Book a free audit and we’ll tell you what we’d check first.