whocanfixmyapp

Home / Problems / Data and database

Test data and real customer data are in one database

VC-41SupabaseReplitUpdated October 2026By

Quick verdict

Partly fixable yourself. Cleaning rows is doable, separating environments needs a developer

How serious
High
Fix it yourself?
Partly, some steps need a developer
Typical cost
€99–$990 for a single fix, $1,500–$15,000 for a full cleanup (prices)
Top rated for Supabase
Redlab · 10.0/10

What you see. Your own test accounts, fake orders and sample rows sit next to paying customers, and every preview edit touches the live data.

Why it happens

AI builders connect the preview and the live site to the same database because it is the fastest way to show you something working. Lovable's docs say every draft uses the same database as the published app, so a test you run in the editor changes what customers see. On Supabase, the fix is a second environment. Supabase branches are separate environments, each with its own Supabase instance and API credentials, and new branches do not start with any data from your base project.

Replit splits the two by design. The development database holds test data and the Agent can change it. The production database serves real users and the Agent cannot modify it. Older apps forked under the legacy setup sometimes still share one database. The risk is concrete: a delete all prompt wipes real rows, test sign-ups inflate your numbers, and a migration tested on live data has no undo.

Fix it yourself

  1. Stop testing on live today. Use a dedicated test account you can recognize, and never ask the AI to clear, reset or reseed a table.
  2. Supabase: create a persistent branch for staging in the dashboard, or a second project. Point the preview at its URL and publishable key, and keep the live keys in the host's production settings only.
  3. Replit: open Publishing > Adjust settings > Secrets and confirm DATABASE_URL differs from the development one. If not, republish with Create production database turned on.
  4. Export the rows you are about to remove as CSV first. Then find test rows by a pattern you trust, such as your own email domain, and delete them in the SQL editor with confirmation.
  5. If a test account is linked to a payment or a subscription, mark it as test instead of deleting it, so the payment records still add up.
  6. Keep the two sets of credentials apart in the host's environment settings, one for preview and one for production.

When to get an engineer

Hire an engineer when real customers already have data tangled with test rows, when tables link to each other through IDs, or when the app has no staging environment at all. Tell them which rows are test, which tables hold money or user records, and whether the preview must keep working. A targeted cleanup is a single fix at €99–$990. Setting up separate environments and migrating the data cleanly runs $1,500–$15,000 over one to eight weeks.

Top-rated companies for Supabase apps

Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.

  • 1Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
  • 2Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
  • 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399

All 29 Supabase companies, ranked

Check these

OPS-02High

Testing and real users use separate databases

Experiments and AI agents should never run against production data.

OPS-01Critical

Database backups run automatically and a restore has been tested

Check what your database plan actually includes, then restore a backup into a test project once.

DATA-03Critical

One user cannot open another user's records

Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.

PAY-04Medium

Failed payments, cancellations and refunds are tested

Use your provider's test cards for declines and disputes, then check what the user sees and what access they keep.

Questions

Is this really dangerous or just untidy?

Dangerous. One careless prompt against the shared database can delete or rewrite customer data, and there is no separate copy to test the fix on.

Does a Supabase branch copy my production data?

Not by default. Branches start without data or storage objects. You can seed them, which is the point: test on safe data.

Sources: Supabase docs: Branching; Replit docs: Development and production databases; Replit docs: Fix a published app using a shared database; Lovable docs: Database.