Book a check-upBook
Menu

Lovable ward

Code review for apps built with Lovable

Lovable gets you from an idea to a working React app with a Postgres database in an afternoon. What it doesn't tell you is which parts only work because nobody has tried to break them yet.

I read the code Lovable generated, your database schema and row level security policies, whether on Lovable Cloud or your own Supabase, and your edge functions. You get a ranked list of what to fix, in plain English, with a fix prompt you can paste straight back into Lovable.

Book a check-up from $149Read a sample report

What Lovable usually generates

  • React
  • TanStack Start
  • Vite
  • TypeScript
  • Tailwind CSS
  • shadcn/ui
  • Lovable Cloud or Supabase
  • Edge Functions
X-raysrc/routes/admin.tsx1 fracture
export default function Admin() {
  const navigate = useNavigate()
  const [customers, setCustomers] = useState<Customer[]>([])
  useEffect(() => {
    getRole().then((r) => { if (r !== 'admin') navigate({ to: '/' }) })
    supabase.from('customers').select('*')
      .then(({ data }) => setCustomers(data ?? []))
  }, [])
  1. The redirect only hides the page. If RLS is off on customers, or its policy allows every row, any logged-in user can run this query from the console.

Common problems in Lovable apps

Not every app has all of these. The report tells you which ones yours has, where, and what to do about each.

  1. Critical

    Row level security that isn't

    Tables with RLS switched off, or policies like using (true), let anyone holding your publishable key (older projects call it the anon key) read or change every row. That key ships in your JavaScript bundle by design, so this is the first thing I check.

  2. Critical

    Business rules that only live in the browser

    Plan limits, prices and admin roles checked inside React components can be bypassed from the browser console. I list every rule that has to move into a policy, a database function or an edge function.

  3. High

    Secret keys in frontend code

    OpenAI keys, Stripe secret keys and email API tokens pasted into components or VITE_ variables are sent to every visitor. I find them and tell you which ones to rotate.

  4. High

    Edge functions that trust everyone

    Functions that skip JWT verification, trust whatever is in the request body, or call paid APIs with no limit per user. One script can run up your bill overnight.

  5. Medium

    Components that grew to 800 lines

    Each new prompt adds another branch to the same file. I point out what to split so that changing the pricing page stops breaking the dashboard.

  6. Medium

    Database types that drifted from the database

    Supabase types generated once and never again mean TypeScript checks your code against a schema that no longer exists, and stops catching the bugs it is there to catch.

Treatment plan

How it works

  1. Book a check-up

    Choose a tier and tell me where to send the report. Add your app's address if it is live. Two minutes, no sales call.

  2. Show me your code

    Pay by card, then give me read-only access to your code on GitHub (you paste in a key I send you) and let me into your app with test accounts. Never done that? I send you step-by-step instructions for your tool. I measure your app and confirm it fits before I start.

  3. Get your diagnosis

    Ready to launch, or not yet. Problems ranked, critical ones proven on your live app, each with a prescription for your AI tool. A PDF by email, then 7 to 30 days of questions by email.

  4. Fix it, then a free follow-up

    Fix the problems yourself, with your AI, or let me do it with the Fix Pack. Tell me within 30 days and I check once more that they are really gone.

Pharmacy

Pick your treatment

Same fixed prices, whichever tool wrote the code.

Check-up

Safety Scan

Is it safe to let real people in? The five things to fix first.

App size
Up to 20k lines of code
Ready in
2 business days

$149

Founding price for the first 10 customers, 10 left. Then $199.

  • A diagnosis: ready to launch, or not yet
  • The 5 problems to fix first, each checked by a human in your code
  • Every critical problem proven on your live app, with screenshots
  • Strangers in your users' data, leaked keys, payment holes, made-up packages
  • A prescription for each problem: a prompt for your AI tool
  • Discharge instructions for your AI, so it stops repeating them
  • 7 days of questions by email, so you are not alone with the report
  • A free follow-up check within 30 days, once you have fixed them
  • Want more afterwards? The price counts toward a Launch Review or Fix Pack within 30 days
Book Safety Scan

My
pick

Full exam

Launch Review

About to launch? Everything I find, and a call where I explain it.

App size
Up to 30k lines (50k: +$299)
Ready in
4 business days

$799

  • Everything in Safety Scan, including the free follow-up check of every problem
  • Every problem I find, not just the top 5
  • Logins, permissions and database rules, checked end to end
  • Will it survive real users? Speed, crashes and runaway costs
  • 30-minute video call where I explain it, no jargon
  • 30 days of questions by email
  • Bigger than 30k lines? +$299 up to 50k, and I tell you before I start
Book Launch Review

Surgery

Fix Pack

Don't want to fix it yourself? I do the fixing.

App size
Up to 30k lines of code
Ready in
5 business days

$1,499

  • A Safety Scan of your app, up to 30k lines of your code
  • A fix list with my time estimate. You approve it before I change anything
  • I fix the top problems myself, up to 6 hours of work
  • More to fix after that? I keep going at $199 an hour, only in blocks you approve first
  • Every change explained in plain English, with a "how to test this" note. Nothing goes live until you approve it
  • A second scan after the fixes, so you know they worked
  • 30 days of questions by email
Book Fix Pack

No idea how big your app is? That’s normal, and you never have to count anything. Book the review you want; I measure your app before I start and tell you. If it doesn’t fit, you choose: upgrade, narrow it down, or a full refund. “Lines of your code” means the code you and your AI wrote, not the packages and UI kit your tool installed; many apps built with Lovable, Bolt or v0 fit the Safety Scan.

Start small, upgrade later. The Safety Scan’s price counts in full toward a Launch Review or Fix Pack for the same app within 30 days of your report.

Why this price? Software does the first pass, so you pay for the part only a person can do: checking every finding in your code, proving the critical ones and deciding what matters for your app. I take at most 3 Safety Scans and 2 Launch Reviews (or one Fix Pack) a week; if this week is full, yours starts the next.

Prices in US dollars, paid once, no sales call and no surprise invoice: anything extra is your choice, told to you before I start. The clock starts when I can see your code. Reports arrive as a PDF by email, in English, or German if you prefer.

Need a few things fixed after a scan? I fix by the hour at $199, three hours minimum, with the list agreed before I start.

Bigger than 50k lines, or a real mess? Rescue jobs are quoted, from $3,000, no obligation. Email me.

Not for you if

  • you have a team of engineers who already review each other’s code,
  • your app’s backend isn’t JavaScript or TypeScript (Python Replit apps, for example), or it is over 100k lines,
  • you handle regulated data (health records, banking, children), or need a pentest, certificate or compliance sign-off. Taking card payments through Stripe is fine.

A review lowers your risk a lot. It can’t guarantee that your app is secure, and nobody honest will say otherwise.

Lovable questions

Can you review a Lovable project that isn't on GitHub yet?

Lovable can sync your project to a GitHub, GitLab or Bitbucket repository in a few clicks. Do that, then give me read-only access (I send you a key to paste in; it takes a minute). I also need your database schema and policies. On Lovable Cloud, export them from the Cloud settings; on your own Supabase, a schema-only dump of the database is enough.

Is it a problem that my Supabase publishable key is public?

No. The publishable key (older projects call it the anon key) is meant to be public. It is only safe when row level security is enabled on every table and every policy is correct, which is exactly what I check.

Can I fix the findings inside Lovable?

Yes. Every finding comes with a fix prompt you can paste into Lovable chat, or into Cursor or Claude Code if you have moved to an editor.

Why not just ask my AI to review it?

Do, and I will even give you the prompt. You will get a long list. What your AI cannot do is tell you which items are real, prove them against your live app, see your database and hosting settings, or check that its own fixes worked. If you cannot read code, that is the part you cannot do yourself either. It is what you pay me for.

I'm not a developer. Is this for me?

Yes, that is exactly who it is for. If you built an app with AI and cannot tell whether the code is any good, I check it and explain what matters in plain English. You never need to understand the code to act on the report: every problem comes with a prompt you paste into your AI tool. And you do not need to know what to ask. The report answers the questions you would have asked if you knew how.

How do I show you my code?

Most AI builders can push your app to GitHub, a free site that stores code. You give me read-only access by pasting a key I send you into your repository settings, which means I can look but not change anything. Never done it? After you book, I send you step-by-step instructions for your tool. A zip file works too. When the report is delivered, remove my access again; I remind you.

Is my code safe with you?

Every booking comes with an NDA, automatically. I never sell, publish or pass on your code. The only other party that sees it is the AI provider that helps with the first pass, under terms that do not allow it to train on your code. I never need your passwords or your live database, and I delete my copy within 7 days of delivering the final report.

Reviews for other tools

Find out what Lovable skipped.

From $149 for the first 10 customers (10 left). Ready within 2 business days. If the Safety Scan finds no problem rated medium or worse, you pay nothing.

Book a check-upRead a sample report

Visiting hoursBook any time. I reply within one business day.