TOOLS
Lovable ships a whole app. Read the back half.
Lovable puts a real interface in front of users fast; the risk sits behind it, in permissive database rules and keys the browser can reach. Humanized Code reviews the back half of your Lovable app for $50 and puts what it finds in writing, with a fixed repair quote, in 48 hours.
01
A polished front over a thin back
The interface is what it is best at, and the result is genuinely good — better looking than most agencies ship, in an afternoon. Behind it sits a database created quickly, and that is where the attention needs to go. Tables generated to fit the screens, row-level security either not enabled or left permissive because switching it on broke the page you were building, and an edge function holding a service key that the browser can reach.
The consequence is specific rather than theoretical: your table names and your data shape are visible to anyone who opens the network tab, and if the access rules are open, so is the data. This is the single most common serious finding in Lovable projects, and it is a configuration fix rather than a rebuild.
02
Prompt-level fixes tend to widen doors
When something is blocked by a permission, the fastest instruction is "make it work", and the fastest way to satisfy that is to loosen the rule rather than fix the query behind it. Do that three or four times over a build and your database is effectively public, with no single moment where anyone decided that.
Watch the environments as well. It is easy to end up with preview and production pointing at one project, so a test signup, a test deletion or a schema change during a demo touches the same rows real customers are using.
$50 FLAT — FINDINGS + A FIXED QUOTE IN 48 HOURS
$50
Flat initial review
48h
Written findings + fixed quote
START THE REVIEW
- How do I check my access rules myself?
- Open your Supabase project, look at policies per table, and treat any table holding customer data whose policy is effectively "allow everyone" as urgent. That single screen answers most of the question.
- I've never exported the code. Can you still review it?
- Yes. Connect the GitHub sync, or add the reviewer to the project. We only need to read.
- Will I have to leave Lovable to fix things?
- Usually not. Most of what we find is policy configuration, a function moved server-side, or a query tightened — all of it lands in the same project.
- What is included for $50?
- A senior engineer reads the generated code and the data layer together, then writes up what is exposed, ranked, with a fixed price to close it.