Review request

Built my first SaaS with Lovable, would love a security gut-check before launch

Solved · 14 views · asked last week by noor_builds · edited

Repo or live app

freelance-invoices.vercel.app ↗

This is a simple invoicing tool for freelancers, live at the link below. Lovable generated most of the CRUD and the login screens. Before I let real people sign up I'd like a second pair of eyes on how it's wired, especially who can see whose invoices.

Comment

2 answers

Marked as helpful by the asker

lena_opslast week · edited

Went through the flow with two test accounts. The invoice list is scoped correctly, good. Two things I'd fix before real users:

The /api/export route returns every user's invoices as CSV, no auth check at all, I could hit it logged out.
Check the redirect URLs list in Supabase auth settings matches your production domain exactly, not just the preview one.

Fix the export route first, that's the real hole.

Comment

mira_devlast week · edited

Adding to Lena's point: put the export behind the same RLS-backed query instead of a separate service-role call, then a missing auth check can't leak anything even if you forget to add one later.

Comment

Keyboard shortcuts

Built my first SaaS with Lovable, would love a security gut-check before launch

Repo or live app

2 answers

Your answer

Built my first SaaS with Lovable, would love a security gut-check before launch

Repo or live app

2 answers

Related

Your answer