Rescue by builder · Lovable
Rescue for Lovable apps
Lovable apps often use Supabase for the database and accounts. That makes a few settings matter a lot: who can read each table, which keys reach the browser, and how payments are confirmed.
Common issues we check for in Lovable apps
- DB-001 — Tables readable without logging in
- DB-002 — Row-level security turned off on a table
- DB-003 — Policies that let anyone write
- SEC-003 — A Supabase service key in browser code
- SEC-004 — Secrets in VITE_ variables, which are sent to the browser
- AUTH-003 — Roles stored where users can edit them
- PAY-001 — Stripe webhooks without signature checks
How we fix them
One small pull request per problem, with a test and rollback steps, reviewed by a Rivyva engineer. You merge.
What you need
Your app's code in a GitHub repository, and its live URL. Connect your Lovable project to GitHub first (Lovable's GitHub sync), then install our GitHub App on that repository.
Questions
Will your fixes break Lovable's editor?
Our pull requests are ordinary code changes on a branch. Lovable syncs with GitHub, so after you merge, the changes appear in your project. If Lovable later rewrites a file we changed, the next Watch scan will tell you.
Do you need my Supabase password?
No. For a deeper check you can give us a time-limited, read-only access token, and you can revoke it at any time. Without it we still check your code and your public site.
Rivyva is independent and not affiliated with or endorsed by Lovable. Lovable is a trademark of its owner.