Built it with Lovable? Make sure your database isn't public.
Lovable gets you to a working product fast, with a real database behind it. The catch is that the database is open to the browser by design, and a single layer of rules is all that stands between your data and anyone who looks. A Defuse review checks that layer — and everything around it — before someone else does.
Where Lovable apps tend to leak
- Row-Level Security left off, or too loose. Lovable apps talk to the database straight from the browser, with a key that ships to every visitor. The only thing deciding who can read or change a row is a set of Supabase RLS policies. Missing or permissive, and your whole database is readable — often writable — by anyone.
- Public storage buckets. Files one user uploaded — IDs, invoices, photos — sitting in a bucket anyone can read if they have, or guess, the link.
- The admin key in the wrong place. The service key bypasses every rule. It belongs on a server you control, never in the browser or an edge function that hands it back.
- Auth that looks finished but isn't. Sign-in works, so it feels done — but the rules that should stop a logged-in user reaching another user's data were never written.
- Secrets in edge functions. Keys for email, payments or AI pasted into functions, then logged or exposed through settings left open.
None of this means Lovable is the wrong choice. It means the review is worth doing — these are defaults and omissions, not deep flaws, and they're fixable.
You've already done the hard part.
You worked out what the product should do, and real users proved you right. That's the part that takes judgement, and it's yours. What's left is engineering — making the thing you designed safe, solid and able to grow — and that's a known quantity, not a mystery. The point of a review isn't to take Lovable away; it's to let you keep building fast without the nasty surprise.
What a Defuse review gives you
- A findings report, ranked by real-world risk, in plain English with the technical detail underneath
- A Keep / Fix / Rebuild verdict, with the reasoning shown
- A remediation plan your AI tool can actually follow
- A 45-minute walkthrough call
It's a fixed £950, and you own the report — you can take it to any developer. Most Lovable apps start and finish with Defuse; where a finding needs closing, that's the next step, not a precondition.
Built with something else? There are notes for Bolt · Replit too.