A production deployment checklist for Lovable apps: custom domains, environment variables, Supabase configuration, and the failures that only appear after going live.
Your Lovable app worked yesterday. After a platform update, a deploy, or a 'security fix' prompt, everything broke. Here's how to triage regressions and when to stop prompting.
Users sign up but never get a confirmation email? Password reset links go nowhere? Supabase's built-in email is rate-limited and lands in spam — here's how to fix it.
Sign in with Google works on localhost but redirects to localhost:3000 on your Lovable preview or custom domain? It's almost always Supabase URL configuration — here's the fix.
Why ~70% of Lovable apps ship with row-level security disabled, what CVE-2025-48757 means for your app, and how to enable RLS without breaking everything.
AI-built sites are client-side rendered — Google may index an empty shell and AI crawlers see nothing at all. Here's how to check and how SSR fixes it.
