Case studies
Documented public incidents (with sources) and anonymized client engagements — what broke, how it was diagnosed, and what fixed it. Same services, fixed prices.
E-commerce store (anonymized client engagement)
Documented: Linkable (linkable.site) + 170 apps on Lovable Launched
Matt Palmer's coordinated disclosure found 303 exposed endpoints across 170 Lovable projects — including Linkable, a Lovable marketing site. What happened, what leaked, and how I fix the same pattern for founders.
CVSS 8.26; 303 endpoints / 170 projects exposed in scan; payment_status bypass on Linkable
Documented: Linkable (linkable.site) — Lovable marketing product
Matt Palmer's May 2025 re-test of Linkable showed payments could be marked 'paid' via a direct Supabase POST — bypassing Stripe. The same RLS class of bug breaks legitimate webhook flows in Lovable SaaS apps.
Unauthorized POST set payment_status=paid; legitimate webhooks fail for same RLS/env reasons
Documented: Ishwar Rimal's Lovable + Supabase project (public write-up)
A published Medium walkthrough by Ishwar Rimal (Intuit) describes the exact failure: Google OAuth works locally but redirects to localhost on Lovable preview URLs. Industry triage data puts this at ~15% of broken Lovable deploys.
Root cause = Supabase Site URL still on localhost; fix published Mar 2025
Documented: Andreea Papillon (PM, no dev team) — public Medium series
Andreea Papillon's published 3-part series describes building with AI without dev resources: 90% backend bugs, auth taking 3–5× longer, and Claude/Cursor going in circles for days. The rescue pattern I sell exists because of stories like this.
Published playbook: stop after 3 loops, debug summary, sleep as a tool