Lovable Pre-Launch Security Checklist

Secrets and keys

Search the deployed JavaScript for secret prefixes. Third-party API calls (OpenAI, Stripe secret, Resend) should go through Supabase Edge Functions with secrets stored in the function's environment.

Database and storage

Enable RLS on every table, write owner policies, keep user uploads in private buckets, and test each table with the anon key.

Auth settings

Turn on email confirmation if you rely on email identity, restrict redirect URLs to your domains, and review who can sign up.

Checklist

• No secret keys in the client bundle
• Third-party APIs called from Edge Functions
• RLS enabled + policies on every table
• Private buckets for user uploads
• Auth redirect URLs restricted
• Edge Functions verify JWTs
• Security headers on the custom domain
• No /.env or source maps public
• Rate limits on costly functions
• Backups / point-in-time recovery understood

Copy-paste fix prompt

Run a pre-launch security review of this Lovable project: list secrets used in client code, tables without RLS, public storage buckets, edge functions that don't verify the JWT, and auth redirect settings. Propose fixes for each.

FAQ