Is your Lovable app ready for real users? Ten checks

AI builders get you to something that works remarkably fast. What they do not do is tell you which of the things they skipped will matter once real people and real money arrive.

Here are the ten checks, in the order we run them on a takeover. Each one includes what it costs you if it is wrong.

1. Is row level security on for every table?

Check: the Table Editor flags any table with it disabled. Cost if wrong: anyone with your URL reads your whole database. Both values they need are in your JavaScript.

2. Do your policies check anything?

Check: read each policy’s condition. true means everyone. Cost if wrong: identical to having no security, with a reassuring green tick.

3. Is your secret key out of the browser?

Check: search your deployed bundle for service_role. Cost if wrong: every policy above is bypassed. This one outranks all the others.

4. Does the server decide what users can do?

Check: hiding an admin button is not access control. Call the admin endpoint directly as a normal user and see what happens. Cost if wrong: anyone who opens developer tools has admin.

5. Are payments confirmed by webhook?

Check: does access get granted when Stripe’s webhook says so, or when the browser returns to a success page? Cost if wrong: anyone can open the success URL and get a paid account for free.

6. Is the webhook signature verified?

Check: your handler should verify Stripe’s signature header before trusting the body. Cost if wrong: a faked request grants anything.

7. Does one place own who has what?

Check: if two tables both store a user’s plan, they will disagree. Which one does billing write to, and which does your app read? Cost if wrong: cancelled users keep access, paying users lose it, and both arrive as support tickets.

8. Do refreshes and shares work?

Check: reload a deep page. Copy its URL into a new window. Cost if wrong: a broken share link is a lost customer, and it is a single redirect rule to fix.

9. Do uploads have limits?

Check: file size, file type, and a storage policy so one user cannot read another’s files. Cost if wrong: either your storage bill or your users’ private documents.

10. Can you get your data out?

Check: are backups on, and do you have database access independent of the builder? Cost if wrong: your business lives inside one vendor’s account.

What to do with the results

If checks 1 to 6 all pass, you are in better shape than most launched apps and the rest is tuning. If any of 1, 2, 3, 5 or 6 fails, fix it before you take a single real customer. Those five are the difference between a bug and an incident.

The honest version of this advice: none of these are hard to fix. They are hard to know about, which is why apps launch without them and find out later.