Security for apps built with Lovable

Lovable builds a full-stack app on Supabase. Risk number one: a service_role key in the frontend, or tables without Row Level Security, hand an attacker your whole database straight from the browser.

The fix: enable RLS on every table, ship only the anon public key to the frontend, never put service_role in a JS bundle, and call AI providers through Edge Functions.