I review apps built with Lovable and Supabase before they take payments. The question I answer: can one user read or change another user's data? Async and in writing: findings by severity, the evidence for each, and how to fix it. I never ask for passwords, secret keys or production customer data. I run my own SaaS with a paid plan on React, TypeScript and Supabase, with Row Level Security I configured and live Stripe payments with idempotent webhooks. English or Portuguese.... Read more