Fix login when wrapping a web app for iOS
Wrapping a Lovable web app for iOS meant magic links opened Safari, Google OAuth was blocked in the web view, and Apple required Sign in with Apple.
Auth, sessions & access
AI writes login quickly but often misses expiry, logout and who-can-see-what. Test logging out, expired sessions and another user's data before launch.
6 items · 3 stories · 3 security incidents
Get Supabase RLS right for a mobile app
Two near-beginners shipped a mobile app built on Replit. The steepest learning curve was getting row-level security policies right.
Make AI-written login actually log users out
A builder had AI write their login flow almost instantly, then lost an afternoon working out why users were never logged out.
Check a Lovable app for exposed user records
A researcher found 16 flaws in one showcased Lovable app for exams and grades, including an inverted auth check that let logged-out visitors in. Teacher and student records were exposed; Lovable says its pre-publish scan had flagged issues the owner didn't fix.
Check who can actually open your private app
Wiz found that undocumented Base44 endpoints let anyone register for private enterprise apps using only a non-secret app ID. Base44 patched it quickly after disclosure.
Harden a vibe-coded app before launch
A builder shipped a Lovable/Cursor + Supabase app in three days. Researchers then wrote to the database via a Postgres view that bypassed RLS, and created accounts through Supabase Auth sign-ups that were never switched off.