Guide Lovable

Hiring someone to fix your Lovable app's security: what to ask first

By the PatchAndShip team Last verified:

Short answer

Before you hire anyone, ask eight things: what exactly is in scope, whether the price is fixed or hourly, what access they need (never your password), whether they confirm you own the app or are authorized to change it, what the refund terms are, what they test and how you'll see it worked, who approves each change, and what you get at the end. Good answers are specific and in writing. Lovable runs its own Expert program with a partner directory. PatchAndShip isn't part of Lovable's Expert program.

Where people look

You can hire a freelancer on a marketplace, an agency, or a specialist service. Lovable also runs an Expert program for "Individual freelancers and agencies under five people building websites, apps, and internal tools for clients on Lovable." Certified members get "A verified profile in the Lovable partner directory." (Lovable Expert Program)

PatchAndShip isn't part of Lovable's Expert program.

Whoever you pick, the same questions apply.

1. What exactly is in scope?

Ask for a list, not "a security review". For a Lovable app on Supabase, that usually means Row Level Security on every table, storage buckets, secret keys in the code, and auth settings. Also ask what's out of scope.

2. Fixed price or hourly?

Both can work. With hourly work, ask for an estimate and a cap. With a fixed price, ask exactly what the price covers and what costs extra.

3. What access do you need?

You shouldn't have to share your password. Lovable lets you invite people to a project from Share. (Lovable: Share a project) Ask what role they need, and how you remove them afterwards.

4. Do you check that the app is mine?

A careful provider only works on apps you own or are authorized to change. Expect to be asked, and expect access to come through invites from your own accounts.

5. What are the refund terms?

Get them in writing: what counts as done, by when, and what happens if it isn't done?

6. What will you test, and how will I see it worked?

Ask for before and after evidence. Two tests anyone can repeat: call your API logged out with only the public key, and sign in as two test users to confirm neither can see the other's rows. Both are in our guide: How to check a Supabase app before launch.

7. Who approves each change, and can it be undone?

Ask who reviews changes before they reach your live app, whether they test on a preview first, and how they roll a change back if something breaks. This matters most for database migrations.

8. What do I get at the end?

A short written report: what was found, what was changed, what's left for you to do, and which keys to rotate.

Before you hire anyone, run Lovable's own Security view. Lovable's docs say its security tools "do not replace a thorough security review," but they're a useful first pass. (Lovable: Security overview)

How PatchAndShip answers these

  • Scope: six areas, listed item by item in What we check and fix.
  • Price: fixed, per app.
  • Access: "For Lovable, invite us to your project as an Editor by email from Share; if you're on Lovable Cloud, that one invite covers the backend too, so no separate Supabase invite is needed. Remove us from Share > Project access when we're done."
  • Ownership: "Paid checks run only after the owner consents." Access comes only through invites you send from your own accounts. (Security and access policy)
  • Who approves: AI agents run the checks and a human engineer approves every change. "Before anything reaches production we write down a rollback plan: how to revert the code change and reverse each migration." (How a job works)
  • At the end: "a short report of what was found and fixed."
  • Security Fix, $149 one time: RLS fixes on every table, storage bucket policies, a scan for exposed keys, key rotation guidance and a short report.
  • Fix & Deploy, $249 one time: everything in Security Fix, plus the production deploy (env vars, auth redirect URLs, custom domain and SSL).

Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase. The Launch Pack is not covered. “Critical” and “live” are defined in our Refund Policy.

Refund Policy: https://patchandship.com/refunds.html#guarantee

Compare both packages · Not sure yet? The free check is a passive check of your public homepage, its scripts and its security headers: exposed secret keys, missing headers and public storage links found in the code (the bucket itself is never opened or listed).

FAQ

Does Lovable's Expert certification cover security?

Lovable's App builder track covers "Authentication, database security, and connectors." Whoever you hire, certified or not, the eight questions above still apply.

Can I fix it myself instead?

Often, yes. Start with How to fix Supabase RLS in a Lovable app and the Lovable security checklist.

Should I rotate keys after someone has worked on my app?

If they could see secrets, we recommend it: remove their access first, then rotate any secret they could see. Public keys, such as a Supabase publishable or anon key, don't need rotating.

Questions before you buy?

Email patchandship@gmail.com.