Production architecture & security
The work that separates something that demos well from something that holds when real people depend on it.
What has to be true before an AI-built app can carry real users?
Before real users arrive, an app needs data designed to outlast its first screen, permissions enforced on the server, tests over the journeys that cost you customers, a rehearsed way back from a bad release, and a named person who answers when it breaks.
Read the production guideEverything in production architecture & security.
From prompt to production: what's true first
Your Lovable prototype works. Here is the map of what has to become true before real paying users arrive: data, permissions, payments, auth, recovery.
How to read an AI-built backend for security
A plain-English walk-through for non-technical founders: how to sanity-check the backend an AI builder generated, and when to call an engineer.
Lovable app slow with real users? Find out why
Why a Lovable app that was fast in testing gets slow with real users, how to find the cause in DevTools and Supabase, and what to ask Lovable to fix.
Why did my Supabase bill suddenly go up?
Why a Supabase or Lovable Cloud bill jumps: how usage is billed, where to see what grew, the usual causes in AI-built apps, and how to cap spend.
Lovable users can see each other's data
Why one user of a Lovable app can see another's records, how to confirm it safely with two test accounts, what to do first if data leaked, and the fix.
Lovable API key exposed: what to do now
Which keys are safe in a Lovable app's browser code, what to do in the first hour after a leak, and how to move the key into a server-side secret for good.
Lovable security scan: what it misses
What Lovable's quick and deep security scans check, what they miss, what common warnings mean and what to do, and where a human review finds problems.
Is Lovable HIPAA compliant? What to do
Lovable is not HIPAA compliant and signs no BAA. See who HIPAA covers, what counts as PHI, and the practical paths for a health app built in Lovable.
ADA accessibility for AI-built apps
Why ADA website lawsuits matter to US founders, what WCAG 2.2 AA asks for, and how to test and fix a Lovable app yourself, with prompts you can paste.
Vibe coding security risks, and how to fix them
The security risks of vibe coding: exposed data, leaked keys, trusting the browser, fake packages and unsafe AI features, with a test and a fix for each.
How to hand over an AI-built app to developers
How to hand over a Lovable or AI-built app to developers: accounts to move, the handover pack, how GitHub sync works, and how to test it is complete.
Backups and disaster recovery for Supabase apps
What Supabase backs up on Free, Pro and PITR, what it leaves out, how Lovable Cloud backups work, and how to rehearse a restore before you need one.
Supabase RLS policy examples and mistakes
Supabase RLS policy examples for owner, team, public, admin and storage access, with a test for each and common mistakes that break or open your tables.
How to test an AI-built app before launch
How to test a Lovable or AI-built app before launch: which journeys to test first, two-account access checks, payment failures, and tests on every change.
What is an audit log?
An audit log is a permanent, append-only record of who did what in a system. What belongs in one, how it differs from app logs, and why buyers want it.
Authentication vs authorization
Authentication proves who a user is; authorization decides what they may do. The difference, with examples; why AI-built apps often get only the first right.
What is a background job?
A background job is work an app does outside the user's request, like sending email, through a queue that can retry. What it is, and why live apps need them.
What is CI/CD? Continuous delivery explained
CI/CD means every change is built and tested automatically, then released through an automated pipeline. What CI and CD each mean, and why apps need both.
What is a code audit?
A code audit is a structured review of a codebase for security holes, reliability risks and maintainability. What it covers, and when an AI-built app needs one.
What is a data processing agreement (DPA)?
A data processing agreement is the GDPR contract between a business and a supplier that handles personal data for it. What a DPA covers, and who needs one.
What is a database index?
A database index lets the database find rows without scanning the whole table. What an index does, and why apps without the right ones slow down as they grow.
What is end-to-end testing?
End-to-end testing drives a real browser through a user's whole journey, such as sign-up to checkout. What E2E testing is, versus unit and integration tests.
What is a feature flag?
A feature flag is a switch that turns a feature on or off for some or all users without a new release. What flags are for, the four kinds, and how they fail.
What is idempotency?
Idempotency means running an operation twice has the same effect as once, so retries never charge or send twice. What it is, and how idempotency keys work.
What is incident response?
Incident response is the plan for detecting, containing and recovering from outages and breaches, then learning from them. What it involves for a small team.
What is load testing?
Load testing puts an app under realistic traffic to measure how it performs before users do. What it is, how it differs from stress testing, what to watch.
What is MCP (Model Context Protocol)?
MCP, the Model Context Protocol, is an open standard connecting AI assistants to apps through tools. What it is, how it works, and why products are adding it.
What is multi-factor authentication (MFA)?
Multi-factor authentication asks for two or more kinds of proof at sign-in, such as a password and a one-time code. What MFA is, and how it differs from 2FA.
What is multi-tenancy?
Multi-tenancy means one app and database serve many customers, each walled off from the others. What it is, how isolation is enforced, and where it fails.
What is OAuth? Delegated sign-in explained
OAuth 2.0 lets an app act on a user's account elsewhere, such as reading Gmail, without their password. What OAuth is, and how it relates to Google sign-in.
What is observability?
Observability is knowing what a live system is doing, and why, from its logs, metrics and traces. How it differs from monitoring, and what a new app needs.
What is a penetration test?
A penetration test is an authorized, simulated attack on your app by testers to find weaknesses that can be exploited. What it covers; when to get one.
What is point-in-time recovery (PITR)?
Point-in-time recovery restores a database to its exact state at a chosen moment, not just last night's backup. What PITR is, and how it relates to RPO and RTO.
What does production-ready mean?
Production-ready software is safe to put in front of real users: secured, tested, monitored and recoverable. What the term covers, as a checkable list.
What is rate limiting?
Rate limiting caps how many requests a user, key or IP address can make in a period. What it protects against, and why AI features need spending limits as well.
What is refactoring?
Refactoring restructures existing code without changing what it does, so the next change is cheaper. What it is, and when to refactor rather than rewrite.
What is regression testing?
Regression testing re-runs existing tests after every change to prove that what worked before still works. What it is, and why AI-built apps need it most.
What is role-based access control (RBAC)?
Role-based access control grants permissions to roles, like admin or viewer, and roles to people. What RBAC is, how it relates to least privilege, and pitfalls.
What is a schema migration?
A schema migration is a versioned script that changes a database's structure, applied in order everywhere. What it is, and why AI-built apps need them.
What is secrets management?
Secrets management is how an app stores, limits, rotates and audits its API keys, passwords and tokens. What it covers, and the leaks it stops in AI-built apps.
What is single sign-on (SSO)?
Single sign-on lets people use one company login for many apps, via SAML or OpenID Connect. What SSO is, and why enterprise customers ask for it before buying.
SLA vs SLO vs SLI: what is the difference?
An SLI measures a service, an SLO sets its target and an SLA promises it in a contract. The difference, what 99.9% uptime means in minutes, and error budgets.
What is SOC 2? The security audit explained
SOC 2 is an independent auditor's report on how a company protects customer data. What it is, Type 1 vs Type 2, and the engineering work that sits behind it.
What is a staging environment?
A staging environment is a private copy of production where each release is checked before real users see it. What staging is, and how it differs from previews.
What is Supabase? Postgres backend explained
Supabase is an open-source backend platform built on PostgreSQL, with sign-in, storage and APIs. What it gives an AI-built app, and what it leaves to you.
Supabase anon vs service_role: which is safe?
The Supabase anon (publishable) key is safe in the browser; the service role (secret) key bypasses row-level security. Which is which, and where each belongs.
What is a webhook? How apps notify each other
A webhook is an HTTP request one service sends your app when an event happens, such as a payment succeeding. How webhooks work, and how they fail in production.
Which rules your product actually has to meet
GDPR, UK GDPR, CCPA, HIPAA, PCI DSS, SOC 2, ISO 27001 and the EU AI Act in plain words: who each applies to and what it means for a Lovable app.
Production readiness checklist for AI apps
Twenty-four checks to run before real users arrive — data, access, testing, recovery and support, in the order they matter.
What is row-level security?
Row-level security is a database rule that decides which rows each user may read or change, enforced by the database. Why AI-built apps need it on every table.