For apps built with Lovable
Fix, secure and launch your Lovable app.
Lovable got you a working app in days. I'm the developer who takes it the rest of the way: database security, payments, SEO, monitoring and code a hire can work on. Usually without starting over, and you can keep building in Lovable.
Independent developer. Not affiliated with Lovable.
supabase/migrations · profiles
Before: anyone with the public key
create policy "Read profiles"
on profiles for select
using (true);After: only the owner
create policy "Owners read their profile"
on profiles for select
to authenticated
using ((select auth.uid()) = user_id);What I fix
What usually needs fixing in a Lovable app
None of this shows up in a demo. All of it shows up when real users, real money or a security review arrive.
01Database rules that let strangers in
What goes wrong: Tables without row-level security, or policies that just say true, so the public key inside your app can read or change other people's data.
What I do: Policies for every table, storage bucket and function, tested as each kind of user, including someone who isn't logged in.
02Secret keys in the browser
What goes wrong: An OpenAI key, a Stripe secret key or Supabase's service-role key in the frontend code, where anyone can copy it.
What I do: Keys moved into edge functions and your host's secret store, the leaked ones rotated, and usage limits on anything that costs money.
03Permissions that only exist in the UI
What goes wrong: The admin button is hidden, but the request behind it works for anyone who sends it.
What I do: Every protected action checked on the server, by role, with tests that prove it stays that way.
04Payments that only work on the happy path
What goes wrong: Unverified Stripe webhooks, access granted by the success page, and nothing for failed cards, refunds or cancellations.
What I do: Signed webhooks that are safe to receive twice, subscription state kept in your database, every billing event handled and tested.
05Invisible to Google
What goes wrong: The app renders in the browser, so search engines, link previews and AI assistants get a nearly empty page with one title for every URL.
What I do: Public pages prerendered or moved to Next.js, each with its own title, description, share image, sitemap entry and structured data.
06Every prompt breaks something else
What goes wrong: Credits burn while one change undoes another, and nobody is sure what the code does any more.
What I do: Tests on the flows that make you money, a pipeline that blocks a broken change, and clean-up where the code has tangled.
07No way back
What goes wrong: Edits go straight to the live app, the schema changes by hand in the dashboard, and no backup has ever been restored.
What I do: Migrations in Git, a staging copy with its own database, tested restores and one-click rollback.
Lovable SEO
Why Google can't see your Lovable app, and three ways to fix it
Lovable builds single-page React apps with Vite: the server sends an almost empty HTML file and the browser builds the page. Google can run that JavaScript, but later and less reliably. Link previews on LinkedIn, X and WhatsApp, and most AI crawlers, don't run it at all.
Option 1
Prerender the public pages
Keep the Lovable app as it is and serve ready-made HTML for the pages people search for: home, pricing, features, blog. The smallest change, and you keep building in Lovable.
Best for: Most apps
Option 2
A Next.js site in front, the app stays in Lovable
A server-rendered site on yourapp.com and the app on app.yourapp.com. Full control over SEO and speed, while the app keeps its Lovable workflow.
Best for: Content, blogs and many landing pages
Option 3
Move the whole app to Next.js
Server rendering everywhere, in one codebase. You'd keep building with Cursor or Claude Code instead of Lovable.
Best for: Apps whose logged-in pages must rank too, like marketplaces
Whichever fits, every public page gets its own title, description and share image, structured data, and a sitemap submitted to Google Search Console.
How it works
Working on your Lovable project together
You keep ownership of everything, and you never have to hand over a password.
- 1
Connect GitHub
Turn on Lovable's GitHub sync and invite me to the repository. I never need your Lovable login.
- 2
Share the access the job needs
Invites to your Supabase organisation and your hosting, with the lowest role that works. Revoke them any time.
- 3
I work in branches, you keep shipping
My changes arrive as pull requests with a preview link. We agree who touches what, so nobody overwrites anybody.
- 4
Handover that sticks
Docs, a walkthrough video, and instructions for Lovable's AI about how the app now works, so the next prompt doesn't undo the fix.
Pricing
Fixed prices. No hourly surprises.
You know the full price before any work starts, and it only changes if you change the scope.
Launch Audit
Find out exactly what's wrong before you spend more.
€900CHF 900$990
Fixed price · 5 working days
- Review of your code, database rules, login, API keys, payments and hosting
- Written report: every issue ranked by risk, with the fix
- Fix it or rebuild it: an honest recommendation
- A fixed quote, if you want me to do the work
- 45-minute call to walk you through it
Credited in full if you book a sprint within 30 days.
Most popular
Launch Sprint
Your prototype, fixed, hardened and live.
from€4,900CHF 4,900$5,400
Exact price fixed by the audit · 2–3 weeks
- Everything in the audit
- Every critical and high-risk issue fixed
- Login, roles and database rules done properly
- Payments that reconcile: checkout, webhooks, subscriptions
- Error monitoring, backups and a staging environment
- Tests on the flows that make you money, run on every change
- Handover docs and a walkthrough video
- 30 days of free bug fixes after launch
MVP Build
When the prototype is the spec, not the foundation.
from€12,000CHF 12,000$13,500
Exact price fixed after scoping · 4–8 weeks
- Scoping session: what version one needs, and what it doesn't
- Built on a stack any developer can pick up: TypeScript, Next.js, Postgres
- Accounts, payments, emails, admin panel and analytics
- Web app, plus iOS and Android if you need them
- Security and privacy built in from day one
- Launch, handover and 30 days of free bug fixes
Care plan
After launch: uptime and error monitoring, security and dependency updates, backups checked, and up to 4 hours of fixes or small changes every month. Cancel any time.
from €490CHF 490$540 / month
Prices for businesses, excluding VAT where it applies. Invoiced by a registered Swiss business in EUR, CHF or USD. Sprints and builds: 50% to start, 50% on delivery.
Will I still be able to use Lovable?
Yes, in the usual case, where we keep the Lovable app and fix it. My changes go through GitHub, so Lovable sees them, and I leave instructions for Lovable's AI so the next prompt doesn't undo them. If moving to Next.js would serve you better, I'll explain why first; after that you'd keep building with Cursor or Claude Code.
Do you need my Lovable login?
No. Lovable's GitHub sync plus invites to Supabase and your hosting are enough, each with the lowest role that works.
Is my Lovable app too far gone to fix?
Rarely. Most Lovable apps have a sound core: the screens, the flows, the data model. If a rebuild really is cheaper, the audit shows you why, with numbers, and your Lovable app becomes the spec.
Can you move my app off Lovable's hosting?
Yes: to Vercel, Netlify or Cloudflare on your own account, with your domain, security headers and preview deployments for every change. The code stays in your GitHub, so Lovable can keep syncing with it.
How much does it cost to fix a Lovable app?
The Launch Audit is a fixed EUR 900 (CHF 900, USD 990) and tells you exactly what your app needs. Most Lovable apps fit a Launch Sprint, from EUR 4,900. A full rebuild starts at EUR 12,000. You get a fixed quote before any work starts.
Show me what you built.
Book a free 30-minute call and bring your app link or repo. You'll leave knowing what it needs to be production-ready, what that costs and how long it takes. If I'm not the right person for it, I'll tell you.
Prefer writing? angelo.lamonaca@pm.me. I reply within one working day.