If you only do three things: turn on row-level security for every Supabase table and test it as a second user, move every secret key out of your React code, and verify your Stripe webhooks. Those three cause most of the serious problems we see.
Lovable is genuinely good. You describe an app, and a few hours later you have a working React front end with a Supabase database, authentication and even payments. We've seen founders get further in a weekend than they used to in a month.
But "it works when I click through it" and "it's safe for strangers on the internet" are different bars. The AI builds what you ask for. It rarely asks the awkward questions: what if a user edits the URL? What if the payment fails halfway? What if two people sign up with the same email at once?
This checklist is written for Lovable, but almost all of it applies to apps built with Bolt, v0, Cursor or Replit too.
Security and data
1. Every table has row-level security switched on
In Supabase, open each table and check RLS is enabled. A table without RLS is readable by anyone holding your public anon key, which is in your front-end code by design.
2. Policies match who should see what
Enabled isn't enough. A policy like "authenticated users can select all rows" means any signed-up user can read everyone's data. Most tables need a check against auth.uid().
3. You've tested as a second user
Make two accounts and try to read or edit one user's data while logged in as the other. Do it through the app and through the API.
4. No secret keys in the browser
Search your code for Stripe secret keys, OpenAI keys and the Supabase service-role key. Anything secret belongs in an Edge Function or server, never in React code.
5. Exposed keys have been rotated
If a secret was ever in the front end or a public repo, assume it was copied. Generate a new one and revoke the old.
6. Storage buckets are private where they should be
Uploaded invoices, IDs or private files shouldn't sit in a public bucket. Check bucket settings and storage policies.
Accounts and payments
7. Auth redirect URLs point to your real domain
Set the Site URL and redirect URLs in Supabase Auth to your production domain, or confirmation and password-reset links will send users to a preview URL.
8. Auth emails send from your own domain
Set up custom SMTP so sign-up and reset emails come from your domain, reach inboxes, and aren't held back by the default sending limits.
9. Stripe webhooks are verified
Your webhook handler should check Stripe's signature, so nobody can fake a "payment succeeded" event and unlock paid features for free.
10. Cancellations and failed payments really lock things
Cancel a test subscription and let a test card fail. Does the user lose access when they should? Most AI-built apps only handle the happy path.
Running it for real
11. Backups are on, and you know how to restore one
Check your Supabase plan's backup settings. A backup you've never restored is a hope, not a plan.
12. There's a staging copy
A second Supabase project and preview deploy, so you can test changes before your users find the bugs.
13. Errors reach you, not just your users
Add error monitoring so you hear about crashes when they happen, not in a one-star review.
14. Heavy pages are fixed
Compress images, lazy-load anything below the fold, and check your JavaScript bundle size. Slow apps lose users quietly.
15. Pages that need to rank can be indexed
Lovable apps render in the browser. For landing pages that need Google traffic, add prerendering or a separate static marketing site.
How did you do?
Be honest. If you ticked everything, you're in better shape than most apps we see at launch. If items 1 to 4 had you wincing, fix those before anything else. They're the ones that leak customer data.
And if you'd rather have someone go through it for you, that's exactly what our Lovable app rescue does. The first look is free, and we'll tell you which of these 15 you can safely leave for later.
