For Cursor, Lovable, Replit, Bolt and Claude Code
A checklist for your stack. Every check shows its title. The first two checks in each section include why it matters, how to check it, and a prompt to paste into your coding agent. The rest of those details are a one-time purchase. Error fixes stay free.
Checklists / Lovable + Supabase
Lovable + Supabase
Ticks are saved in this browser only.
Security
Lovable often creates Supabase tables that the browser can reach with the anon key. If row level security is off, anyone who can see that key can read or change every row. Generated projects have shipped with open tables, so this is the first check.
The service role key bypasses row level security. If it is bundled into the Lovable app, anyone can extract it from the browser and read the database. The anon key is the only Supabase key that belongs in frontend code.
The checks are written for that tool. A Lovable app does not fail in the same places as a Worker.
Progress stays in this browser. There is no account. Clearing site data clears the ticks.
The prompt tells an agent what to change. You still need to read the result before you ship it.
Postgres refused an insert because row level security is on and no policy allows that row.
The database role behind the API key does not have a GRANT to use that table.
The key sent to Supabase is missing, truncated, or from another project.
The access token the app sent is no longer valid.
Leave an email if you want a note when new checks are added. Nothing is sent yet.