Help · Projects built with AI
Lovable app with Supabase in production: what to review
To put a Lovable app with Supabase into production, review the tables' access rules (RLS), separate test from production, confirm only the public key is in the browser, turn on backups, set up login emails and keep the code on GitHub. Without that, the app works in the demo and fails, or leaks data, with real customers.
Reviewed on
Access rules (RLS): the most critical point
In Supabase, row level security (RLS) decides who reads and who changes each piece of data. A table without a rule, or with an open rule, lets anyone with the link read every customer's data. Before opening the app, every table needs rules tested with different users.
Keys: which one can go to the browser and which can't
The public key (anon) was made to go to the browser, as long as the access rules are right. The service key (service role) ignores the rules and must never appear in the site's code. If it has already gone to the browser or to GitHub, rotate it.
Separate test and production
One Supabase project for testing and another for production. Database structure changes go to test first, with a backup made before they reach production. Mixing the two is the most common way to delete customer data by accident.
What else to review
Automatic backups and a test restore. Login and password recovery emails sent from a company address, not the default. Free plan limits, which pause inactive projects. Code synced with GitHub. And your own domain with HTTPS.
When to call someone
You don't always need to. When you do, this is it.
If your Lovable app is about to receive customers, we review the access rules and keys, separate test and production, set up backups and emails, publish it on your domain and follow the app after launch.
Related service
Projects built with AI→Review, deploy on your domain and maintenance.
Frequently asked questions
Is the Supabase free plan enough for production?
To start, sometimes. Projects with real customers usually need a paid plan, including for backups and so the project isn't paused.
How do I know if my app is leaking data?
By testing access to the tables with different users and without logging in. It's one of the first things we review.
Can I keep editing in Lovable?
Yes, with the code on GitHub and a review before publishing, so a change doesn't open the database rules.
Do you deploy outside Lovable?
Yes, on hosting in your company's name, keeping Supabase.
Do you work with clients outside Brazil?
Yes. We work with companies anywhere in Brazil and abroad, through video calls and WhatsApp, in English or Portuguese.
Keep going
You talk to the people doing the work
Want your app ready for real customers?
You talk directly to Gabriel, on WhatsApp, in English or Portuguese. Send what happened and the project or website address, if there is one.