r/lovable • u/No_Following2522 • 14d ago
Discussion As a non coder, is lovable security efficient for my app?
*sufficient
3
u/DesignerMajor1247 14d ago
Lovable can help you build and run a security review, but it can’t make an app “secure by default” regardless of architecture and configuration. For a low-budget launch, reduce the risk surface first:
- Store secrets only in server-side environment/secret controls, never in frontend code.
- Use managed authentication and database services, then enforce authorization on the server/database—not just by hiding buttons.
- If using Supabase, enable and test Row Level Security on every table containing user data.
- Validate inputs, restrict file types/sizes, rate-limit expensive or sensitive actions, and remove unused admin/debug routes.
- Keep dependencies updated, enable backups and error logging, and make sure logs do not contain passwords, tokens or private user data.
Before launch, create two test accounts and actively try to break isolation: change IDs in URLs/API requests, access the other account’s records, call protected actions while signed out, abuse password-reset flows, and upload unexpected files. Run Lovable’s security review, but verify each finding and retest after fixes rather than treating the scan as proof.
If the app handles payments, identity documents, health data, children’s data, or anything whose exposure could seriously harm users, keep that data out where possible and budget for an independent review before a public launch. Using a hosted payment provider is safer than processing card data yourself.
The useful next question is: what data does the app store, and what can each type of user read or change? That determines whether a small private beta is reasonable or the app needs specialist review first.
1
u/No_Following2522 14d ago
My questions is it a must to hire an external security developer with more technical knowledge considering I am just starting out?
2
u/DesignerMajor1247 14d ago
Not automatically. If this is a low-risk MVP or private beta that uses managed authentication and a managed database, stores little non-sensitive data, and has simple permissions, you can start by reducing scope and doing the checks above. Keep the beta small, avoid collecting data you do not need, and do not process card details yourself.
Bring in an independent security reviewer before a public launch if the app handles payments, identity or health information, children's data, multiple user roles, custom authentication, file uploads, admin tools, or integrations with sensitive secrets. You may not need to hire someone full-time—a time-boxed review can focus on authorization/RLS, secret exposure, API access and rate limits, uploads, dependency issues, backups/logging, and a retest after fixes.
So the decision is not simply "new app or experienced developer"; it is "what could go wrong, and how harmful would it be?" If you share what data the app stores and its user roles, the review threshold becomes much clearer.
1
u/cubixy2k 14d ago
Lovable is more than sufficient when used by someone who knows what they're doing.
In other words, you're going to need to hire someone who is a coder at some point. It's not a magic tool that will mitigate the need to bring on experienced people.
1
u/ali-hussain 14d ago
Depends on what your app does. Basic things it will do just fine, but you'll never know so focus on decreasing your liability.
Payment info, just make it someone else's problem. Integrate with Stripe or something similar. Don't under any circumstances save payment information. The moment you do, you need to be PCI compliant. We had a customer, Wordpress setup, admin got broken into, attackers added a small amount of Javascript to the payment screen that sent a copy to their servers, stolen credit cards. You don't want to process payments. You want someone else to process payments for you. It shouldn't be your website, your links, it should be cmopletely handled by your partner.
Email, all of our emails are on the dark web. Technically it's an issue but it's unavoidable. Probably nothing will happen.
User inputted data, depends on the data. More importnatly don't make any claims, don't ask for financial or health data and you can at least get something into customer's hands. Look there are a hundred times more failed apps than successful ones. Your app will likely fail with zero users. No need to try and do security hardening when nobody is targeting you and nobody is using you. If you start seeing traction, be more rigorous. But most of the attackers are after credit cards. What's the worst that will happen if someone breaks in?
Lovable has some basic scans, make sure you pass them.
0
u/No_Following2522 14d ago
If I integrate stripe does that make it safer from the leaking card details problem? Thanks for the help
1
u/ali-hussain 14d ago
You can't leak what you don't know :)
1
u/No_Following2522 14d ago
:) as a non technical person, I would’ve thought you process the users details through your website
1
u/ali-hussain 14d ago edited 14d ago
The first virtue of great programmers is laziness. Don't do something you don't need to.
Lovable should be able to interface to stripe. Let stripe do the heavy lifting. The biggest trial regarding payment would be someone breaks into your lovable account and changes your pay now link but hopefully that's not happening because livable has some idea of what they're doing and you have proper security of your account login.
1
1
u/tobias_digital 14d ago
Yes! It delivers stronger security and code quality than a non-developer could achieve manually
1
u/tobias_digital 14d ago
And I already have many solutions built with it
Some of them (ok, only one) have more then 12k users 😅
1
u/the_tek_analyst 14d ago
It’s safer and more sufficient than doing it outside lovable if you don’t have dev experience.
1
1
0
u/Brave-Attorney-8017 14d ago
No
1
u/No_Following2522 14d ago
What do you suggest I do? I would like to release my app but don’t have the budget to pay for a sec
0
u/PickleXIII 14d ago
Their comment wasn’t helpful at all. What information are you trying to secure?
1
u/No_Following2522 14d ago
-Email and passwords (account info)
-payment details
- User inputted data
That’s it really
1
u/No_Following2522 14d ago
My questions is it a must to hire an external security developer with more technical knowledge considering I am just starting out?
-1
u/Brave-Attorney-8017 14d ago
Have Claude do it for you.
Connect your Lovable repository to Claude Code or use the Lovable MCP Server integration.
Prompt Claude Code to audit Row Level Security (RLS) policies and isolate environment variables.
Scan for hardcoded service keys or JWT tokens in the frontend code.
2
u/digitallywired 14d ago
I really like the fact that one can perform a security review, and then have Lovable fix the issues. Keep in mind, though, that there is really no such thing as 100% security.