Monitor your Lovable app.

How a Lovable app runs in production

A Lovable app goes live when you press Publish: Lovable deploys a snapshot to a lovable.app address — or your own domain, on a paid plan — and nothing you change afterwards reaches visitors until you publish again.

Behind it is usually Supabase, through Lovable Cloud or a project of your own, for sign-in, the database and edge functions; and Stripe for payments, called from an edge function that holds your secret key. Lovable can keep the code in a GitHub repository, synced both ways.

What breaks after launch

• Anyone can read your Supabase tablesLovable creates tables as you describe features. One left without row level security can be read with the public key every visitor downloads — a 2025 scan of Lovable apps found 170 of 1,645 exposing data that way (CVE-2025-48757).How to tell, and the fix
• Sign-in breaks on your new domainMoving from the lovable.app address to your own domain leaves Supabase’s redirect URLs naming the old one, so sign-in fails on the new address and nowhere else.How to tell, and the fix
• Sign-up emails do not arriveA Supabase project still on its built-in mailer sends only a few auth emails an hour. On launch day the rest of the sign-ups never get theirs.How to tell, and the fix
• Checkout succeeds; the order never happensLovable’s Stripe guide leaves the webhook for you to set up in Stripe. Until it exists and answers, a customer can pay and the app never hears about it.How to tell, and the fix

What Keelnest watches

• The site, every five minutes

  The address, its certificate and its security headers, requested the way a browser asks; an incident opens after two failures in a row, never on one blip.

• Every publish

  Lovable announces no publish, so every check fingerprints the live page; a new version is checked within five minutes and walked by your journeys.

• Sign-in and checkout, in a real browser

  Walked after every publish and on your plan’s schedule, sign-up emails and magic links included; a payment journey stops before the pay step.

• Supabase

  Every check reads the auth redirect URLs, the sign-in mailer, the security advisor’s findings and failed sign-ins, with a token Keelnest only reads with.

  Supabase

• Payments

  A read-only Stripe key compares payments with what that hour of the week usually brings, and reads webhook endpoints and failed deliveries.

  Stripe

• Errors

  One script tag reports uncaught errors and failed requests — never form values or request bodies — so an incident says what broke. Sentry works too.

  Error captureSentry

Fixes: a prompt, or a pull request

Incidents come with the fix: steps, and a prompt to paste into Lovable’s chat saying what broke and what to change, never with a secret in it. On a paid plan with GitHub sync on, Keelnest can prepare the fix as a pull request on the synced repository instead; nothing merges until a named person approves it, and Lovable’s sync brings the change back into the project. Settings outside the code — Supabase’s redirect URLs, Stripe’s webhooks — come as steps, with a link to the exact page.

Setting it up

1. Add the app’s live address — the lovable.app one or your own domain. The first check runs straight away.
2. If the app uses a Supabase project in your own account, connect it with an access token, which Keelnest only reads with; if it takes payments, connect Stripe with a restricted key.
3. Write one journey — sign in, or reach the checkout — in plain words. It is walked after every publish.
4. For fixes as pull requests, turn on GitHub sync in Lovable and install the Keelnest GitHub App on that repository.

Or start without an account: the free health check reads any live address in a few seconds.

Questions

Sources

What Lovable does, as its own documentation described it on 23 September 2026. Builders change quickly; if something here is out of date, tell us.

• Lovable · Publishing
• Lovable · GitHub integration
• Lovable · Stripe
• Supabase · Custom SMTP
• CVE-2025-48757 write-up

Other builders

• Bolt
• v0
• Replit
• Cursor