A Lovable app may already be in production in the strict sense: published, accessible and used. Before increasing its exposure, verify the safeguards that a demo cannot show. They cover access, ownership, backups, growth and the ability to hand the project over.
Lovable can now use Supabase or Lovable Cloud. The exact checks differ, but the following six questions apply to both.
1. Do access rules protect every record?
Supabase-compatible backends use Row Level Security, or RLS, to decide who can read, change or delete each row. A public key in the browser is expected. Protection comes from table policies and tests using several user roles.
2. Are authentication and authorisation complete?
Test sign-up, sign-in, session expiry, password recovery, account deletion and server-side route protection. Hiding a page in the interface is not an authorisation rule.
3. Who controls the critical accounts?
GitHub, the Lovable workspace, any Supabase project, the domain, payment keys and transactional email accounts should belong to the organisation behind the product. Administrative roles and two-factor authentication should be documented.
4. Can backups be restored?
Set a frequency that matches the level of activity and test the restore procedure. Files stored outside the database also belong in the recovery plan.
5. Does the app fit the expected usage?
Compare the hosting plan, queries, data volume and integrations with expected concurrent users and availability requirements. There is no universal threshold between prototype and production.
6. Can another team take over?
The repository should build outside Lovable and required configuration should be described. For Lovable Cloud, migration is possible, but data, users, files, secrets and authentication providers do not all travel automatically with the code.
You can check account ownership, two-factor authentication, backup status, alert contacts and visible journeys without coding. Access policies, server-side protection, dependencies and capacity require technical review. The launch checklist separates those levels, while the Scan documents the second.
If you are still building, KERN-IT also offers coaching as a Lovable expert in Belgium. You remain in control while we help with decisions, without changing or extracting the application. Delivery by our team is a separate engagement.