Skip to content
SSShipSafeStack

Ship guide

Ship a Lovable app

Lovable can host the app and may also offer auth and payments, or the project may be connected to Supabase or another backend. This list is about the project you have open, not about Lovable in the abstract.

Updated 16 Oct 2026 · Directory entry

A checklist for this builder, not a promise the app is production-safe. Confirm every setting in the project you actually generated.

  1. 01

    See which backend this project uses

    Open the project settings and the environment variable list. Note whether data lives in Lovable's own infrastructure, in Supabase, or somewhere else. Advice for Supabase RLS does nothing if this app is not on Supabase. Write the answer down before you change anything.

  2. 02

    Find every public variable

    Search for keys in the client. Variables that the framework exposes to the browser are public even if the dashboard row looks private. Follow the API key checklist. The anon or publishable key can stay. Secret, service-role, and email API keys cannot.

  3. 03

    Lock the data

    If the database is Supabase, walk the RLS checklist on every table, with two users. If it is another store, do the equivalent: a second account must not read the first account's rows. Try while logged out.

  4. 04

    Put money and mail on the server

    If you take payments, the browser must not be the thing that decides a customer paid. For Stripe, use the webhook checklist. Password resets and receipts go through Resend or Loops from a server route.

  5. 05

    Scan the URL you will actually share

    Preview links are often public. Run one security scanner against the production URL, with permission, after the steps above. Then turn on error monitoring so the next failure is not a screenshot in your inbox.

  6. 06

    Do the general pass

    Finish with the pre-launch checklist. It is still not a guarantee. It is the list of things this kind of project gets wrong.