away from lovableYou are here when
People other than you sign up, store their data in your app, or pay you.
What usually goes wrong at this stage
- “Row level security enabled” is not the same as safe. Row Level Security is the set of rules in your database that decides which rows each person may read and change (Supabase docs). Switched on, it can still let anyone insert, update or delete, as an owner found on a live app (r/nocode, August 2026). Nothing breaks when a rule is too open, so nobody notices until someone else does.
- A secret key in the code the browser downloads. Supabase’s secret keys bypass Row Level Security and must never leave your control (Supabase docs). Lovable’s docs warn that
VITE_variables end up in the code sent to the browser (Lovable docs). - Server functions anyone can call, and anything that costs you money each time it runs, like an AI call or an email, with nothing stopping one person running it a thousand times.
- Not knowing where the backups are. On Lovable Cloud, Lovable keeps a daily backup for roughly 14 days under More → Cloud → Database → Backups, and restoring one loses everything written since (Lovable docs). On your own Supabase, daily backups come with the Pro plan and up; the free plan has none (Supabase docs).
What it costs: a couple of hours once, then one habit before every release. Nothing has to move, and it works inside Lovable. A fix to a table rule is a database change, so on Lovable Cloud it goes live through Lovable’s chat (stage 2).
What this stage gets you
A written answer to “what can a stranger reach?”: which tables someone who is not logged in can read or change, which functions anyone can call and why, where every secret key is, what costs money per use and what limits it, and where your backups are. The free LaunchGuard scan checks your live address from the outside; it cannot test everything, including access behind a login.
When to move on
This stage does not end; the check before each release stays. For the next move, see the six stages.
Short answers for this stage
The full stage, step by step with the agent prompts, is in the paid guide that comes with the kit.