Debug webhooks that fail only in the native app
Wrapping a Lovable app with Capacitor led to failing RevenueCat webhooks. The cause was Supabase's own auth check running before the code, which none of the AI tools spotted.
Supabase: real stories
11 items
Fix login when wrapping a web app for iOS
Wrapping a Lovable web app for iOS meant magic links opened Safari, Google OAuth was blocked in the web view, and Apple required Sign in with Apple.
Get Supabase RLS right for a mobile app
Two near-beginners shipped a mobile app built on Replit. The steepest learning curve was getting row-level security policies right.
Move a Lovable project into your own repo early
Over about three weeks a PM shipped an education platform, started in Lovable, hit its limits, moved to their own repo with Claude Code, and then rebuilt on Next.js for SEO.
Fix Stripe webhooks rejected by Supabase auth
On launch day a Supabase function rejected Stripe's webhook because it required a user login token, so a paying customer stayed on the free tier.
Turn on GitHub secret scanning before launch
GitHub secret scanning added detection for Lovable API keys and Supabase tokens; leaked Lovable keys in public repos are reported to Lovable for revocation.
Close an open Supabase database
Researchers reported more than 16,000 Supabase databases reachable through vibe-coded apps, over half showing signs of personal data.
Check a Lovable app for exposed user records
A researcher found 16 flaws in one showcased Lovable app for exams and grades, including an inverted auth check that let logged-out visitors in. Teacher and student records were exposed; Lovable says its pre-publish scan had flagged issues the owner didn't fix.
Keep agent tokens out of public database tables
Wiz found the AI-agent social network Moltbook running a Supabase backend whose public key allowed reading the database, exposing large numbers of agent API tokens and user data. It was fixed after disclosure.
Harden a vibe-coded app before launch
A builder shipped a Lovable/Cursor + Supabase app in three days. Researchers then wrote to the database via a Postgres view that bypassed RLS, and created accounts through Supabase Auth sign-ups that were never switched off.
Turn on RLS in a Lovable + Supabase app
Two researchers scanned 1,645 showcased Lovable apps and found 303 Supabase endpoints in 170 projects readable or writable without login, exposing emails, payment details and API keys.