Resources — Guides for AI-built products

Guide12 minFrom prompt to production: what's true firstYour Lovable prototype works. Here is the map of what has to become true before real paying users arrive: data, permissions, payments, auth, recovery.

Guide11 minHow far a prompt gets you, and where it stopsAn honest map of what AI prompting in Lovable does well, where it reliably stops, and how a non-technical founder can tell the two apart.

Guide14 minHow to read an AI-built backend for securityA plain-English walk-through for non-technical founders: how to sanity-check the backend an AI builder generated, and when to call an engineer.

Guide14 minLovable app slow with real users? Find out whyWhy a Lovable app that was fast in testing gets slow with real users, how to find the cause in DevTools and Supabase, and what to ask Lovable to fix.

Guide14 minWhy did my Supabase bill suddenly go up?Why a Supabase or Lovable Cloud bill jumps: how usage is billed, where to see what grew, the usual causes in AI-built apps, and how to cap spend.

Guide14 minLovable emails going to spam: causes and fixesWhy sign-up, password-reset and receipt emails from a Lovable app land in spam or never arrive, how to find the cause yourself, and how to fix it.

Guide14 minLovable credits running out? Fix bugs for lessWhy Lovable credits vanish on fixes that do not stick, what each mode costs per the current docs, and a routine that spends fewer credits on the same bug.

Guide14 minHow to add a developer to your Lovable projectGive a developer access to your Lovable app without handing over the keys: the invite path and safest role in Lovable, GitHub, Supabase, Stripe and Google.

Guide14 minLovable users can see each other's dataWhy one user of a Lovable app can see another's records, how to confirm it safely with two test accounts, what to do first if data leaked, and the fix.

Guide14 minLovable API key exposed: what to do nowWhich keys are safe in a Lovable app's browser code, what to do in the first hour after a leak, and how to move the key into a server-side secret for good.

Guide14 minLovable security scan: what it missesWhat Lovable's quick and deep security scans check, what they miss, what common warnings mean and what to do, and where a human review finds problems.

Guide14 minLovable app: Stripe paid but user not upgradedWhy a Lovable app still treats paying Stripe customers as free, how to find the cause in Stripe and your logs, and how to fix affected customers for good.

Guide14 minLovable Google login not working: the fixesFix Google sign-in in a Lovable app: redirect_uri_mismatch, login that only works in preview, the supabase.co consent screen and Google's Testing mode.

Guide14 minWhy every Lovable fix breaks something elseLearn why a Lovable fix breaks other features and burns credits, how to stop the loop with version history and Plan mode, and when to call engineers.

Guide15 minLovable app blank after publishing: the fixesFind out why a Lovable app works in preview but shows a blank page, a 404 or endless loading once published, and how to trace and fix each cause.

Guide14 minIs Lovable HIPAA compliant? What to doLovable is not HIPAA compliant and signs no BAA. See who HIPAA covers, what counts as PHI, and the practical paths for a health app built in Lovable.

Guide14 minLaunch checklist for US founders of AI appsThe business-side go-live checklist for a US founder with a Lovable app: Stripe live mode, sales tax, Google sign-in, privacy policy, support and backups.

Guide14 minADA accessibility for AI-built appsWhy ADA website lawsuits matter to US founders, what WCAG 2.2 AA asks for, and how to test and fix a Lovable app yourself, with prompts you can paste.

Guide14 minLovable payments vs your own Stripe accountCompare Lovable's built-in payments with your own Stripe account: who owns it, who handles sales tax, Paddle vs Stripe fees, and how to switch safely.

Guide11 minLovable Stripe integration: set it up safelyHow the Lovable Stripe integration works, built-in payments vs your own Stripe account, and the webhooks, keys and tests a paying app needs before launch.

Guide15 minHow much does it cost to build an app in 2026?What it costs to build an app or MVP in 2026: AI builders, Lovable developers, agencies, in-house hires and subscriptions compared, plus running costs.

Guide11 minVibe coding security risks, and how to fix themThe security risks of vibe coding: exposed data, leaked keys, trusting the browser, fake packages and unsafe AI features, with a test and a fix for each.

Guide12 minHow to hand over an AI-built app to developersHow to hand over a Lovable or AI-built app to developers: accounts to move, the handover pack, how GitHub sync works, and how to test it is complete.

Guide12 minLovable authentication and secure user rolesHow to add sign-in and user roles to a Lovable app safely: where roles must live, how to protect admin areas, Google sign-in, MFA, and how to test it all.

Guide13 minBackups and disaster recovery for Supabase appsWhat Supabase backs up on Free, Pro and PITR, what it leaves out, how Lovable Cloud backups work, and how to rehearse a restore before you need one.

Guide14 minSupabase RLS policy examples and mistakesSupabase RLS policy examples for owner, team, public, admin and storage access, with a test for each and common mistakes that break or open your tables.

Guide15 minTechnical due diligence before you raiseWhat investors check in technical due diligence, what changes when AI wrote your code, the evidence to prepare, and a 30-day plan before you raise.

Guide12 minScaling a Lovable app: what breaks firstScaling a Lovable app: why the database breaks first, how to fix indexes, connections and slow functions, and how to load-test before a traffic spike.

Guide12 minHow to test an AI-built app before launchHow to test a Lovable or AI-built app before launch: which journeys to test first, two-account access checks, payment failures, and tests on every change.

Guide12 minLovable SEO: why your site is not indexedWhy a Lovable site is not indexed by Google: privacy settings, noindex, robots.txt, client-side rendering, duplicates, and the Search Console fix for each.

Guide12 minHow to choose a tech partner for your MVPHow to choose a tech partner for your MVP: what to decide first, questions to ask, who owns the code, red flags, and why a paid first task beats a pitch.

Guide13 minApp maintenance cost: what an app costs to runWhat it costs to run an app after launch: hosting, database, monitoring, upgrades, security patches and engineering. Sourced prices and a 5-step estimate.

Guide10 minApps built with Lovable that run in productionReal apps built with Lovable, with sources: which run in production, which are pre-launch, and what each one needed after Lovable to carry users and money.

Guide13 minLovable limitations and how to work around themLovable limitations in 2026: credits, backend logic, testing, staging, mobile and migration, with a workaround for each and when to bring in engineers.

Guide12 minRefactor or rebuild your AI-built app?Refactor or rebuild an AI-built app? A six-area scorecard, the signs a rebuild is right, and how to replace an app piece by piece without stopping it.

Guide13 minLovable app to the App Store and Google PlayHow to get a Lovable app into the App Store and Google Play: PWA, Capacitor, wrapper or rebuild, Apple's review rules, Google's testing step and costs.

Guide11 minLovable prototype to production: a case studyHow Looph went from a Lovable prototype to production in 28 working days: the baseline, the gates, row-level security on 172 tables, hosting and releases.

Guide13 minLovable OpenAI integration: keep your key safeAdd OpenAI to a Lovable app safely as of 2026: Lovable AI vs your own key, Secrets and edge functions, per-user limits, spend caps and prompt injection.

Guide13 minLovable email with Resend: reach the inboxSend email from a Lovable app with Resend that reaches the inbox: domain records, Supabase auth emails, the email verification error, retries and bounces.

Guide13 minMost advanced AI models right now (Nov 2026)The most advanced AI right now, checked Nov 3, 2026: Gemini 4 Carbon, Claude Opus 5.5 and GPT-6 Astra, who leads each leaderboard and how they are ranked.

Guide15 minWhich rules your product actually has to meetGDPR, UK GDPR, CCPA, HIPAA, PCI DSS, SOC 2, ISO 27001 and the EU AI Act in plain words: who each applies to and what it means for a Lovable app.

Checklist8 minProduction readiness checklist for AI appsTwenty-four checks to run before real users arrive — data, access, testing, recovery and support, in the order they matter.

Glossary4 minWhat is an AI app builder?An AI app builder turns a plain-language description into a working web app: screens, data and logic. What one does well, and what it leaves for engineers.

Glossary4 minWhat is an audit log?An audit log is a permanent, append-only record of who did what in a system. What belongs in one, how it differs from app logs, and why buyers want it.

Glossary4 minAuthentication vs authorizationAuthentication proves who a user is; authorization decides what they may do. The difference, with examples; why AI-built apps often get only the first right.

Glossary4 minWhat is a background job?A background job is work an app does outside the user's request, like sending email, through a queue that can retry. What it is, and why live apps need them.

Glossary4 minWhat is CI/CD? Continuous delivery explainedCI/CD means every change is built and tested automatically, then released through an automated pipeline. What CI and CD each mean, and why apps need both.

Glossary3 minWhat is a code audit?A code audit is a structured review of a codebase for security holes, reliability risks and maintainability. What it covers, and when an AI-built app needs one.

Glossary4 minWhat is a code handover?A code handover moves software, its knowledge and its access from one team to another. What a complete one includes, and what to ask for before you sign off.

Glossary4 minWhat is a data processing agreement (DPA)?A data processing agreement is the GDPR contract between a business and a supplier that handles personal data for it. What a DPA covers, and who needs one.

Glossary4 minWhat is a database index?A database index lets the database find rows without scanning the whole table. What an index does, and why apps without the right ones slow down as they grow.

Glossary4 minWhat is a development subscription?A development subscription buys software engineering as a flat monthly plan instead of hourly billing or fixed projects. How it works, and how it compares.

Glossary3 minWhat is end-to-end testing?End-to-end testing drives a real browser through a user's whole journey, such as sign-up to checkout. What E2E testing is, versus unit and integration tests.

Glossary3 minWhat is a feature flag?A feature flag is a switch that turns a feature on or off for some or all users without a new release. What flags are for, the four kinds, and how they fail.

Glossary4 minWhat is a fractional CTO?A fractional CTO is a senior technology leader who works for a company part time, setting technical direction without a full-time salary. What one does.

Glossary4 minWhat is idempotency?Idempotency means running an operation twice has the same effect as once, so retries never charge or send twice. What it is, and how idempotency keys work.

Glossary5 minWhat is incident response?Incident response is the plan for detecting, containing and recovering from outages and breaches, then learning from them. What it involves for a small team.

Glossary4 minWhat is load testing?Load testing puts an app under realistic traffic to measure how it performs before users do. What it is, how it differs from stress testing, what to watch.

Glossary4 minWhat is Lovable Cloud?Lovable Cloud is the backend built into Lovable: database, sign-in, storage and server functions on Supabase. What it covers, and what production still needs.

Glossary5 minWhat is MCP (Model Context Protocol)?MCP, the Model Context Protocol, is an open standard connecting AI assistants to apps through tools. What it is, how it works, and why products are adding it.

Glossary4 minWhat is multi-factor authentication (MFA)?Multi-factor authentication asks for two or more kinds of proof at sign-in, such as a password and a one-time code. What MFA is, and how it differs from 2FA.

Glossary4 minWhat is multi-tenancy?Multi-tenancy means one app and database serve many customers, each walled off from the others. What it is, how isolation is enforced, and where it fails.

Glossary4 minWhat is OAuth? Delegated sign-in explainedOAuth 2.0 lets an app act on a user's account elsewhere, such as reading Gmail, without their password. What OAuth is, and how it relates to Google sign-in.

Glossary5 minWhat is observability?Observability is knowing what a live system is doing, and why, from its logs, metrics and traces. How it differs from monitoring, and what a new app needs.

Glossary4 minWhat is a penetration test?A penetration test is an authorized, simulated attack on your app by testers to find weaknesses that can be exploited. What it covers; when to get one.

Glossary4 minWhat is point-in-time recovery (PITR)?Point-in-time recovery restores a database to its exact state at a chosen moment, not just last night's backup. What PITR is, and how it relates to RPO and RTO.

Glossary4 minWhat is product engineering?Product engineering is building and running software as a product: architecture, data, security, testing, releases and operations, end to end. What it covers.

Glossary4 minWhat does production-ready mean?Production-ready software is safe to put in front of real users: secured, tested, monitored and recoverable. What the term covers, as a checkable list.

Glossary4 minWhat is rate limiting?Rate limiting caps how many requests a user, key or IP address can make in a period. What it protects against, and why AI features need spending limits as well.

Glossary4 minWhat is refactoring?Refactoring restructures existing code without changing what it does, so the next change is cheaper. What it is, and when to refactor rather than rewrite.

Glossary4 minWhat is regression testing?Regression testing re-runs existing tests after every change to prove that what worked before still works. What it is, and why AI-built apps need it most.

Glossary4 minWhat is role-based access control (RBAC)?Role-based access control grants permissions to roles, like admin or viewer, and roles to people. What RBAC is, how it relates to least privilege, and pitfalls.

Glossary4 minWhat is a schema migration?A schema migration is a versioned script that changes a database's structure, applied in order everywhere. What it is, and why AI-built apps need them.

Glossary4 minWhat is secrets management?Secrets management is how an app stores, limits, rotates and audits its API keys, passwords and tokens. What it covers, and the leaks it stops in AI-built apps.

Glossary4 minWhat is single sign-on (SSO)?Single sign-on lets people use one company login for many apps, via SAML or OpenID Connect. What SSO is, and why enterprise customers ask for it before buying.

Glossary4 minSLA vs SLO vs SLI: what is the difference?An SLI measures a service, an SLO sets its target and an SLA promises it in a contract. The difference, what 99.9% uptime means in minutes, and error budgets.

Glossary4 minWhat is SOC 2? The security audit explainedSOC 2 is an independent auditor's report on how a company protects customer data. What it is, Type 1 vs Type 2, and the engineering work that sits behind it.

Glossary4 minWhat is staff augmentation?Staff augmentation adds outside engineers to your team, managed by you, for as long as you need them. How it differs from managed teams and subscriptions.

Glossary4 minWhat is a staging environment?A staging environment is a private copy of production where each release is checked before real users see it. What staging is, and how it differs from previews.

Glossary4 minWhat is Supabase? Postgres backend explainedSupabase is an open-source backend platform built on PostgreSQL, with sign-in, storage and APIs. What it gives an AI-built app, and what it leaves to you.

Glossary4 minSupabase anon vs service_role: which is safe?The Supabase anon (publishable) key is safe in the browser; the service role (secret) key bypasses row-level security. Which is which, and where each belongs.

Glossary5 minWhat is a technical co-founder?A technical co-founder is a founder who owns building the product and holds equity for it. What the role involves, and the options when you cannot find one.

Glossary4 minWhat is technical debt?Technical debt is the future cost of shortcuts in code: each later change takes longer until it is paid down. What it is, and why AI-built apps collect it fast.

Glossary4 minWhat is vendor lock-in?Vendor lock-in is when leaving a supplier costs so much you effectively cannot. How it happens with AI app builders and agencies, and how to keep the exit open.

Glossary4 minWhat is vibe code cleanup?Vibe code cleanup is engineering work that makes AI-generated code safe and maintainable for real users. What it covers, and how it differs from a rewrite.

Glossary4 minWhat is vibe coding?Vibe coding means building software by describing it to an AI in plain language and accepting the code it writes. What it is, and where it stops working.

Glossary4 minWhat is a webhook? How apps notify each otherA webhook is an HTTP request one service sends your app when an event happens, such as a payment succeeding. How webhooks work, and how they fail in production.

Glossary4 minWhat is an MVP, really?A minimum viable product is the smallest complete version of a product that gives real users real value. What an MVP is, and how it differs from a prototype.

Glossary8 minWhat is row-level security?Row-level security is a database rule that decides which rows each user may read or change, enforced by the database. Why AI-built apps need it on every table.

Glossary4 minWhat is the real product?The real product is the live version of the app you design in Lovable, engineered and run by Plutonapps. What it is, and why it was once called a Product Twin.

The playbook for shipping what you prompt.

Production readiness checklist for AI apps

Something wrong with your Lovable app?

What do you need right now?

How do I turn an idea into something buildable?

Launch checklist for US founders of AI apps

How much does it cost to build an app in 2026?

Technical due diligence before you raise

How to choose a tech partner for your MVP

Guides for Lovable founders

Compare your options

Everything.

Reading about it is one thing. Shipping it is ours.