What are Lovable security best practices?

The best practices specific to Lovable (not generic OWASP)

Every "security best practices" list tells you to use HTTPS and rotate keys. Those are table stakes. The list below is what actually matters for Lovable apps, based on the risks that appear in real Lovable deployments.

1. Enable RLS on all tables and write policies that verify auth

*Why:* Supabase tables without Row Level Security can be queried by anyone with the public anon key. *Do this:* Enable RLS on all tables and write policies that verify auth.uid() matches data ownership.

2. Move all secrets to server-side functions

*Why:* OpenAI, Stripe, and other API keys hardcoded in frontend code are easily extracted. *Do this:* Move all secrets to server-side functions. Use Supabase Edge Functions for API calls.

3. Enable email verification, enforce password requirements, add rate limiting

*Why:* Missing email verification and weak passwords enable account compromise. *Do this:* Enable email verification, enforce password requirements, add rate limiting.

4. Audit policies to ensure proper ownership checks on all CRUD operations

*Why:* Even if RLS exists, overly permissive policies allow cross-user data modification. *Do this:* Audit policies to ensure proper ownership checks on all CRUD operations.

5. Configure security headers in hosting platform (Vercel, Netlify)

*Why:* Without CSP and other headers, injected scripts can steal sessions and data. *Do this:* Configure security headers in hosting platform (Vercel, Netlify).

Lovable-specific: audit every table for RLS before every deploy

The failure mode in Lovable + Supabase apps is always the same: a table gets added during a feature push, RLS never gets turned on, the full table becomes queryable via the anon key. Bake a pre-deploy check: `select tablename from pg_tables where schemaname = 'public' and not rowsecurity` — the result must be empty.

Verification

Even perfect best practices don't prove themselves — the only way to confirm the list above is implemented is to scan a deployed Lovable app. VAS probes each of supabase security, api key exposure, authentication security, security headers by actually attempting the attack, not just reading headers or docs.