Lovable is good at momentum — you keep prompting, the app keeps growing, and within a few sessions you've got something that looks genuinely finished. That's exactly what it's for.
The catch is that "looks finished" and "is finished" come apart fast once you look under the UI. Iterative prompting builds features; it doesn't naturally build the shared structure, auth checks, or tests underneath them.
The Lovable-specific issues we see most
Same Supabase RLS exposure as Bolt, plus published-preview URLs left live and indexable
Component sprawl from iterative prompting — heavy duplication, no shared primitives
Business logic living inside components rather than anywhere testable
No loading or error states on async operations
Forms with client-side validation only
Third-party keys committed during prompt iterations and still sitting in git history
A checklist you can run yourself
Give this a real go before reaching out — the people who can fix it themselves were never going to hire us, and the ones who read it and realise the scale of the job usually do.
Open your published preview URL in an incognito window — if it loads without login, it's publicly indexable right now.
Check Supabase → Authentication → Policies — Lovable inherits the same RLS defaults as Bolt.
Search your git history for API keys — keys committed during early prompts often survive later "fixes."
Pick your three most-used components and check whether the same button/card/input pattern is duplicated with slightly different code each time.
Find one piece of business logic and check whether it lives inside a component or in a separate, testable function.
Turn off your connection mid-action and see what the UI does — silent failure means no error state.
Bypass the client-side validation on a form (via devtools) and see if the backend accepts the bad data anyway.
Check whether every async data fetch shows a visible loading state, or just stale/empty content while it loads.
When to get help
Worth getting a second pair of eyes on this once real users are on it, payments are involved, you're handling anyone's personal data, or someone other than you will need to maintain this going forward. Below that bar, the checklist above will get you most of the way.
Read the full AI app rescue guide, or see the checklist for Bolt, v0, Cursor or Replit.