Guide Supabase
Getting fake signups or bot accounts on your Lovable or Bolt app? How to stop them
Short answer
Bots can create accounts by calling Supabase's sign up address directly, which skips any check you only added to your sign up form. The fix is to turn on the check inside Supabase itself: in Authentication, under Bot and Abuse Protection, enable CAPTCHA (Cloudflare Turnstile or hCaptcha) and pass the token from your sign up and sign in forms. Also turn on email confirmation so new accounts can't do anything until the email is verified, and review the sign up limits (Auth rate limits).
Two follow ups
- Make sure a brand new account can't write data just because it is signed in. An insert rule that only checks "logged in" lets bots fill your tables.
- Put a usage cap on any button that calls a paid AI service from a server function.
On Lovable Cloud
On Lovable's built in backend (Lovable Cloud), Lovable's docs don't describe a CAPTCHA setting, and at least one user on Reddit reports they couldn't find one. Ask Lovable support, or use your own Supabase project where the setting is under Authentication.
Where we can help
Free instant check: paste your URL at patchandship.com/check.html to scan your homepage's JavaScript for secret keys and security headers (no signup, nothing stored). Paid, fixed price per app: Database Check, $49; Security Fix, $149 (every critical issue on our checklist fixed within 48 hours of working access); Fix & Deploy, $249. Otherwise a full refund if you ask within 14 days of purchase (Refund Policy). AI agents run the checks and a human engineer approves every change. Not a penetration test or a security guarantee.
FAQ
Why doesn't a CAPTCHA on my sign up form stop bots?
Bots can call Supabase's sign up address directly and skip your form. The CAPTCHA has to be enabled in Supabase Auth so Supabase checks the token.
Which CAPTCHA providers does Supabase support?
Cloudflare Turnstile and hCaptcha, under Authentication, Bot and Abuse Protection.
Does email confirmation help?
Yes. With confirmation on, new accounts can't sign in until the email is verified.