Where Lovable apps usually break
- Supabase row-level security left off or too loose: one user can read or edit another's rows.
- Auth emails: confirmation links pointing at the preview URL, or never arriving.
- Data that looks saved in the UI but isn't in the table after a refresh.
- Layouts generated for desktop that overflow on a phone.
- Sample content and placeholder images still in the published app.
Test the published app, not the preview
Put your published URL (your custom domain or the lovable.app one) on the wall, not the editor preview. Testers create their own accounts, so you see exactly what a stranger's first session looks like, including every email Supabase sends.
A brief that works for Lovable apps
- 1Say what the app does and the one task a new user must finish.
- 2Ask testers to sign up with a real address and report anything odd in the emails.
- 3Ask them to try two accounts and check they can't see each other's data.
- 4Tell them which parts are still placeholder.





