Lovable apps, RLS, keys, and auth in Lovable
Ask Lovable to restrict each table to the signed-in user, then open the Supabase dashboard and read the policy. Lovable's integration doc gives the example prompt "Make sure users can only see and edit their own data." Put private keys in Secrets, not in .env under a VITE name.
Fix for Lovable
Ask Lovable to restrict each table to the signed-in user, then open the Supabase dashboard and read the policy. Lovable's integration doc gives the example prompt "Make sure users can only see and edit their own data." Put private keys in Secrets, not in .env under a VITE_ name. Lovable rejects a VITE_ name in Secrets and says those values belong in .env because they are browser-exposed.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Lovable fixes are on the Lovable page.