Supabase RLS: the missing security layer
Why the anon key (now the publishable key) is public by design, how to check whether your tables are exposed with one curl command, and the exact SQL to lock them down.
Guides
Field guides for taking AI-built software to production.
Each guide covers one production gap in AI-built apps: how to check whether you have it, and how to fix it, with the exact commands. Written by the Dualbytes engineering team. A new guide ships most weeks.
The library
Start where it hurts.
Firebase security rules that hold
Test mode is a 30-day timer with two bad endings. How to probe your own Firestore and Realtime Database, and the rules to write instead of allow read, write: if true.
The production-readiness checklist
The six-area standard we review against, published in full: secrets, access, data, reliability, observability, and ownership, with the concrete checks for each.
The leaked API key response plan
Rotate, audit, purge, relocate, restrict: the one-hour runbook for an exposed key, plus the proxy pattern that stops the browser holding provider keys at all.
The 12-point security checklist
The launch-gate list: secrets, database rules, server-side auth, validation, rate limits, storage, headers, dependencies, errors, backups, monitoring, and personal data.
Taking a Lovable app to production
The Lovable-specific launch list: RLS on the Supabase behind it, auth settings, a domain you own, GitHub sync as your escape hatch, and the honest signs it is time to migrate.
Fix a broken app without making it worse
Rank the damage, commit before you prompt, escape the fix-one-break-two loop, and the honest line where a human engineer becomes cheaper than another day of prompting.
Supabase auth: the 8-point check
Email confirmation, redirect allowlists, role storage, sane sessions, and the user_metadata trap that lets users promote themselves to admin.
Why apps fall over under load
N+1 queries, missing indexes, connection exhaustion, unlimited endpoints, and zero caching: the five demo-killers, each with a fix measured in hours.
POPIA, translated for founders
The eight conditions as engineering tasks, the overseas-hosting question answered, breach notification duties, and the data-mapping checklist to run first.
Backups: surviving the AI blast radius
The Supabase free plan has no automated backups, Firestore's point-in-time recovery is off by default, and an AI agent once erased a production database in nine seconds. The exact commands to make sure you have a yesterday.
Moving off Lovable Cloud onto Supabase you own
Lovable Cloud is Supabase that Lovable manages. There is an official export now, but no one-click transfer: your data, users, and files still move by hand. The exact steps for each, and the password catch that traps most migrations.
Runaway API bills and the caps that stop them
A leaked Google key was reported to burn $60,000 in 13 hours, and a budget alert would not have stopped it: Google Cloud budgets do not cap spending. Which providers have real spend caps, which only have alarms, and the ten-minute key lockdown that closes the biggest hole.
Guardrails for AI coding agents
Replit's agent deleted a production database during an explicit code freeze; a Cursor agent did it with one over-scoped token in nine seconds. The four rules that hold when instructions fail, and the exact settings for Claude Code, Cursor, Replit, and your database.
Self-hosting Supabase: what it takes
Fifteen minutes to install, then five self-hosted breaking changes in three months, no branching, and no managed backups or point-in-time recovery. When it is the right call, the hardening list to finish first, and the exact commands to move a managed project onto your own server.
AI agents are using your app
Automated clients now make more than half of all web-page requests, and assistants act for users inside other people's apps. The exact user agents and IP lists to identify them, robots.txt and its limits, rate limiting that survives shared IP pools, and what to check before exposing actions to assistants.
Who trains on your project
Lovable starts training on Free and Pro customer content on 9 September 2026 unless you opt out, and renamed the toggle a fortnight before. What Lovable, Replit, v0, Bolt, Supabase and Firebase each say about your prompts, code and your users' data, the settings to check on each, and how to keep personal information out of a prompt.
When a guide is not enough
Each guide covers one gap. The review covers your app.
Senior engineers go through your actual code and infrastructure: secrets, sign-in, data integrity, reliability, and hosting you own. You get a ranked list of what to fix before real users, what can wait, and what is already fine.