A scan finished in March 2025 checked the homepages of 1,645 Lovable sites and found 303 exposed endpoints across 170 of them, about 10.3% (CVE-2025-48757).

Source: Matt Palmer, 29 May 2025

What usually breaks in a Lovable app

Lovable writes a React front end and gives it a backend: its built-in Cloud, or a Supabase project you connect yourself. The front end usually talks to the database directly, so the access rules on each table are what stop one user from reading another user’s data.

• Row-level security off, or rules that let any logged-in user read every row.
• Stripe payments that work in test mode but never update the database in production.
• Password reset and magic links that point to localhost or the preview URL.
• A secret key in the front-end code or the GitHub repo. Supabase’s secret key skips every row-level security rule.
• No tested way back. Reverting a version in Lovable restores your code, not your database data.
• No separate test database. A Git branch does not give you one, so a test can touch real users’ data.

The scan is from March 2025 and covered homepages only, not logged-in pages. Its author works at Replit, a competitor. Lovable has added security scans since, so treat this as a sign of the risk, not a current rate.

Who can fix it

It depends on what a mistake would cost you. If the app holds user data or takes payments, have a senior engineer read it before launch. If it is one small bug and a mistake is cheap, the cheaper routes are fine.

• You, with prompts. Good for layout, copy and small bugs. Lovable scans your database rules every time you publish, and its docs say these tools “do not replace a thorough security review”.
• A Fiverr gig. Good for one small bug you can describe in a sentence. On 29 Oct 2026, gigs for “lovable app fix” had a median starting price of $35, before Fiverr’s buyer fee.
• An Upwork freelancer. Upwork lists $16 to $35 an hour for full-stack developers and $51 to $75 for React developers. Ask to see row-level security work they have done, not just React.
• A certified Lovable partner. Lovable lists Experts and Solution Partners in its own directory. Prices are not published, so you agree them with the partner.
• An agency. Good for a big app and a team of several people. Relux, for example, publishes a $3,000 rescue audit, then fixes from $10,000 up to about $40,000.
• Me. One senior engineer, fixed published prices, and you talk to the person doing the work. The details are below.

Prices were read on 29 Oct 2026, and the Relux prices again on 5 Nov 2026. These routes buy different amounts of work, so a higher price usually means a bigger scope. The full breakdown is at badii.studio/cost-to-fix-lovable-app.

Six checks you can do today

• Database rules. In Supabase, open Advisors, then Security Advisor. An error saying RLS is disabled on a public table means anyone with your project URL can read, edit and delete that data. On Lovable Cloud, read the results of the security scan.
• Two test users. Log in as one user, open the browser network tab, and find a request for that user’s data. If changing the user id in it returns another user’s rows, your rules are too open.
• A real payment. Pay once in live mode, then refund it. The plan in your app should change, and Stripe should show the delivery as successful under Workbench, Webhooks, Event deliveries.
• Password reset. Send yourself a reset email from the live app. The link has to open your live domain, not localhost or a preview URL.
• Secret keys. Search the repo and the site’s loaded JavaScript for sb_secret_, service_role and sk_live_. You want zero hits. If you find one, replace the key, because deleting the line does not make it safe.
• A way back. Find out where your database backup is before you need it. Lovable Cloud keeps daily backups for about 14 days, Supabase backs up paid plans daily, and on the Supabase Free plan you export your own.

The same six checks on one page, for your team or your next launch.

What I do

I connect to your GitHub repo and your backend with read-only access, read the code and the access rules by hand, and test the flows that matter: sign-up, payment, reset, and data access between users. You keep building in Lovable. I fix in the same repo, and Lovable’s GitHub sync works both ways, so my changes show up in your project.

How it works

• Free teardown: a 5 to 10 min recording of what a stranger can see and break in your live Lovable app.
• Tech Check, $995, one time: I read the code and the backend and send findings ranked by risk and a written plan in 5 business days.
• Builder seat, $4,995 a month: the issues fixed one request at a time, then the app taken live. Pause or cancel anytime.

Sources

• Matt Palmer, Statement on CVE-2025-48757, 29 May 2025
• Lovable docs, Built-in backend, read 5 Nov 2026
• Lovable docs, Security, read 5 Nov 2026
• Lovable docs, Version history, read 5 Nov 2026
• Lovable docs, Database backups, read 5 Nov 2026
• Lovable docs, GitHub integration, read 5 Nov 2026
• Lovable partner directory, read 5 Nov 2026
• Supabase docs, Database advisors, read 5 Nov 2026
• Supabase docs, API keys, read 5 Nov 2026
• Supabase docs, Redirect URLs, read 5 Nov 2026
• Supabase docs, Database backups, read 5 Nov 2026
• Stripe docs, Receive Stripe events in your webhook endpoint, read 3 Nov 2026
• Upwork, Hourly Rates by Skill and Experience, 12 May 2026
• Upwork job search for “Lovable”, 100 most recent posts, read 29 Oct 2026
• Fiverr search for “lovable app fix”, first page, read 29 Oct 2026
• Lovable pricing, read 29 Oct 2026
• Relux, Vibe-Code Rescue, read 5 Nov 2026

First published on badii.studio. I review and fix apps built with Lovable, Bolt and other AI tools before launch. If yours has a bug like this, book a Tech Check.

In live mode, Stripe retries a failed webhook for up to three days. Signature checks need the raw request body, so parsing it first makes every event fail.

Source: Stripe docs, Webhooks, read 3 Nov 2026

The usual causes

• The endpoint is registered in a sandbox or test mode only, or still points to a preview URL.
• The signing secret in your environment is from a different endpoint or mode, so every event fails verification.
• The handler parses the body as JSON before verifying it. Stripe signs the raw body, so the check fails.
• The handler is a Supabase Edge Function with JWT verification left on, the default. Stripe sends no Supabase token, so every call gets a 401. Set verify_jwt = false for that function, or deploy it with --no-verify-jwt, and rely on the Stripe signature check instead.
• In an Edge Function, the code reads the body with req.json() or calls constructEvent. Read it with await req.text() and verify it with constructEventAsync and Stripe.createSubtleCryptoProvider(), as in the Supabase example.
• The handler writes with the anon key, and row-level security blocks the write.
• The table is new and has no grants. Since 30 October 2026, Supabase no longer grants new tables to the API roles, so the write fails with a 42501 permission denied error, even with the service_role key.
• The function times out or returns an error, and nothing logs it.
• The app listens for the wrong event, for example checkout.session.completed but not invoice.paid for renewals.

How a reliable setup looks

• One endpoint per environment, each with its own signing secret.
• Signature verified on the raw body before anything else.
• Writes done server-side with a key that never reaches the browser.
• Each event ID stored, so a retried event is not processed twice.
• A 2xx response only after the event is safely stored, with slow work moved to a queue so Stripe does not time out.
• A way to compare Stripe and your database, and fix any that disagree.

Where to look first

In the Stripe dashboard, open Workbench, then Webhooks, pick your endpoint and open Event deliveries. Click a failed delivery to see its HTTP status code. A 400 usually means a signature problem, a 401 or 403 an auth problem, a 404 a wrong URL, and a 500 an error in your handler.

In a sandbox, Stripe retries a failed event only three times over a few hours, so a broken test endpoint goes quiet fast. You can resend an event from the dashboard for up to 15 days.

Sources

• Stripe docs, Receive Stripe events in your webhook endpoint, read 3 Nov 2026
• Supabase docs, Function configuration, read 3 Nov 2026
• Supabase example, Stripe webhooks Edge Function, read 3 Nov 2026
• Supabase changelog, Tables not exposed to Data and GraphQL API automatically, read 3 Nov 2026

First published on badii.studio. I review and fix apps built with Lovable, Bolt and other AI tools before launch. If yours has a bug like this, book a Tech Check.

Upwork lists typical rates of $16 to $35 an hour for full-stack developers, $51 to $75 for React developers and $60 to $120 for penetration testers.

Source: Upwork, Hourly Rates by Skill and Experience, 12 May 2026

Prices by route, October 2026

• Doing it yourself: Lovable Pro is $25 a month for 100 credits, and Business is $50. You can top up credits when you run out. The real cost is your time, and the chance that a prompt hides the symptom and leaves the cause.
• Fiverr: on 29 Oct 2026, the first page of results for "lovable app fix" showed 52 gigs. Starting prices ran from $5 to $750, and the median was $35. That price is the smallest package, and Fiverr adds a buyer service fee at checkout.
• Upwork freelancers: Upwork's own rate guide lists $16 to $35 an hour for full-stack developers, $51 to $75 for React developers, $40 to $90 for cybersecurity developers and $60 to $120 for penetration testers.
• What Upwork clients offer: I read the 100 most recent Upwork job posts matching "Lovable", posted over about two weeks up to 29 Oct 2026. The 35 fixed-price posts had a median budget of $500, from $5 up to $4,000. Half of the hourly posts capped the rate at $30 or less.
• Agencies, hourly: a LITSLINK list of ten US companies that clean up vibe-coded apps puts their rates between $25 and $99 an hour.
• Agencies, fixed packages: Relux publishes a $3,000 rescue audit (1 week), a stabilization sprint from $10,000 (2 to 3 weeks) and a full rework at $15,000 to $40,000. Rocking Tech in the UK charges £1,950 for a code health review, and cites market prices from £5,000 for light stabilisation and £15,000 to £40,000 for a backend rebuild.

Why the numbers are so far apart

The cheap end and the expensive end are buying different things. A $35 gig fixes one bug you can describe in a sentence, like a button that does nothing or a form that won't submit. An agency audit reads the whole codebase, the database rules and the payment flow, then writes up what it found. The hourly rate matters less than the number of hours, and nobody knows that number until someone has looked at the code.

The Upwork budgets show the same gap. $500 buys about 14 hours at $35 an hour, or 4 to 8 hours at a security tester's rate. That covers one or two contained fixes. It rarely covers a review of the whole app. One Lovable and Supabase security review posted at $1,500 had more than 50 proposals three days later. Getting offers is easy. Telling which of those 50 people will actually check your database rules is the hard part.

What usually needs fixing

Security comes up most often, and the public scans show why.

• In May 2025, a scan of 1,645 Lovable projects found exposed Supabase endpoints in 170 of them, about 10.3% (CVE-2025-48757).
• In October 2025, Escape scanned more than 5,600 public apps built on vibe-coding platforms, most of them on Lovable. It found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 cases of exposed personal data.
• Veracode tested more than 100 AI models on 80 coding tasks in 2025. When there was a safe and an unsafe way to write the code, the models picked the unsafe one 45% of the time.

What makes one app cost more than another

• Payments. Every plan, product and webhook is one more flow to test from start to finish.
• User roles. An app with admins, teams and customers needs a database rule for every table and every role.
• How much code the AI wrote. Long prompting sessions often leave duplicate components and dead code that someone has to read before changing anything.
• No staging copy. Without a place to test, every fix goes straight to real users, so it has to be slower and more careful.
• Fix or finish. Fixing what exists costs less than fixing it and also building the features that were never finished.

Hourly or fixed price?

With an hourly contract, you carry the risk. If the job takes twice as long, you pay twice as much. With a fixed price, the developer carries it, which is why fixed quotes usually come after an audit or a call. Either way, get the scope in writing: which issues, what counts as done, and what happens if more turns up.

How to keep the bill down

• Write down every bug you already know about, with the steps to see it. Paying someone to rediscover them is wasted money.
• Fix security before features. A data leak costs more than a late feature.
• Give read-only access first. Never send production keys, the Supabase service_role key or an admin password in a chat message.
• Set up a second Supabase project for testing, so fixes are checked away from real users.
• Agree how you will both work on the repo, so your next Lovable prompt doesn't undo a fix.

Where my prices sit

I sell this work, so here are my numbers next to the ones above. A Tech Check is $995, one time, and takes 5 business days. If it doesn't find at least 5 concrete, actionable issues, it's free. The fixes are done on the Builder seat, $4,995 a month: a flat monthly price, one request at a time, pause or cancel anytime. One blocker is one request. A bigger fix is split into requests, and how many months it takes depends on your app. The Tech Check fee is credited to your first month if you start a seat within 14 days.

The Tech Check costs more than the $500 median fixed budget in the Upwork posts above, and less than the $3,000 Relux rescue audit or Rocking Tech's £1,950 code health review. One month on the Builder seat costs more than most of those Upwork budgets and is under the agency stabilization sprint that starts at $10,000. Even two months, $9,990, is just under it. Which one fits depends on how much of your app needs work, and an audit from anyone is the cheapest way to find out.

First published on badii.studio. I review and fix apps built with Lovable, Bolt and other AI tools before launch.