Guides
The specific bugs that block AI-built apps at launch - what causes them, and exactly how to check for them yourself.
Supabase RLS and the anon key: a 10-minute check without code →
The anon key is public by design, so RLS does all the work. Six checks you can run in the Supabase dashboard and two browser windows: key type, RLS switch, over-broad policies, the two-account test, logged-out requests, storage buckets.
What breaks in Lovable apps: data from 190 live apps →
An outside-in scan of 190 live Lovable-built apps: 94% send no CSP, 79% return 200 for missing pages, 67% have no enforcing DMARC, 3 ship an API key. Method, limits, and a 2-minute self-check for every number.
Lovable password reset email not arriving: 5 reasons and how to check →
Missing SPF/DKIM/DMARC, the shared Supabase dev sender, silent rate limits, a wrong Site URL, or content-level spam filtering - with exact steps to check each one.