Shipping Safely
Hi, I'm
Line Hjartarson
SheBuilds S02 Alum + Lovable Ambassador
Design engineer @ aline.no
Built with Lovable
The gap
Works in the demo ✓
/Safe for real users ?
What security means
Not just hackers in hoodies
Strangers reading your users' data
Someone posting as someone else
Your paid API keys, spent by other people
Real example
CVE-2025-48757
Shipped wide open
170+
apps exposed
0
logins needed
Scope
Enough to ship safely
Three common leaks
One live fix
A checklist to keep
The risks
How a hackathon app leaks
No login
Login but no database rules
Secrets in the frontend
Leak 1
No login
Anyone with the link can read and write
→ add authentication
Leak 2
"The UI is a suggestion.
The database is the law."
Login looks safe, but the database still answers anyone
→ add row-level security
Leak 3
Secrets in the frontend
An open API key is an API key for everyone
→ keep secrets server-side
Demo
Two steps, a few minutes
Before
- ✕No login
- ✕Open database
- ✕Anyone reads everything
After
- ✓Login required
- ✓Own data only
- ✓Each user sees their own
Takeaway
The ship checklist
Auth on anything that stores user data
RLS on every table
No secrets in the frontend
Run Lovable's security scan
My simplest advice
Log in as someone else
The one habit that catches most leaks
Questions?
Thank you
aline.no