For Lovable and Bolt apps
Before your Lovable app takes real users
A read-only audit of your Supabase policies, keys, Stripe and GDPR basics. €390, written report.
Get a quote or write to info@lifkuru.com
Three checks you can do yourself in 20 minutes
- Open Supabase, Authentication, Policies. Any select policy on a table with customer data that reads using (true) is public.
- Sign out of your app, open DevTools, Network tab, reload. Every request to /rest/v1/ that returns rows is data anyone can fetch with your anon key.
- Create two test users. Sign in as one, try to read the other's rows through the API. If it works, so can a stranger.
The same 20-minute check in full: Supabase, keys and functions, Stripe. Every point can be done in your own dashboards.
Paste your policies, it shows which tables anon can read.
What the €390 audit covers
Table by table: who can read, insert, update and delete, and whether the policy matches what the app expects.
Which keys are in the client code, which are server-only, and what the edge functions check before they act.
Webhook signature checks and whether the paywall is enforced on the server, not only in the UI.
Email confirmation, rate limits, password rules, session lifetime.
What personal data is stored, where, who can read it, and whether the privacy notice says the same.
Findings with a fixed-first list: what to fix today, what this week, what can wait. Delivered within five working days after access.
Read-only. We change nothing in your project. We need viewer or read access that you can revoke afterwards.
What happens after
written report; credited against the next project
the fixes from the report: policies, keys, payments, EU hosting
when the prototype needs a rebuild before real users
hosting, monitoring, patches; cancel any month
Prices are final: lifkuru is not VAT-registered, no VAT is added. The audit is credited against the next project. We agree the fixed price in writing before the start.
Why us
- The same assistant runs on lifkuru.com and ajastus.ee, and its code is open: github.com/lifkuru/site-assistant
- We work in Estonian, English and Russian.
- On request we sign an NDA and a data processing agreement before work starts.
Send the link to your app
Write what the app does and where it runs (Supabase, Stripe, hosting). We reply within one business day in Estonian, English or Russian: what we check and when the report is ready.
Get a quote or write to info@lifkuru.com