By Before you pay, confirm three things: they will read your code and database before quoting, they work from invites to your accounts rather than your passwords, and you keep the code and the written findings. A Lovable certificate is a plus, not a substitute for those three.
Lovable developer is now a job title. Lovable launched a Partner Directory in September 2026, where certified experts list projects they have shipped. Certification is assessed on published work, and experts must complete Lovable Academy courses on security and client delivery. That is useful. It is not the same as a developer who has read your project.
One thing to know about the directory. Experts earn a 10% commission on every Business plan subscription they bring to Lovable. That is a normal partner arrangement, and it also means some advice may lean toward staying on Lovable. Ask directly how they are paid.
Questions to ask on a call, not by email:
- Will you read the code and database before you quote? The right answer is yes, with read access to the GitHub repository and an invite to the Supabase project or Lovable workspace. A small paid review is fine.
- How would you check that one user cannot see another user's data? Listen for two test accounts and a look at the RLS policies. If they say the Lovable scan covers it, keep looking.
- Where should secret keys live, and what do you do if one leaked? Secrets belong in the project's server settings, never in the front-end code. A leaked key gets rotated the same day.
- How do you make payments and the app agree? The answer involves a Stripe webhook with a verified signature, running on a server function, not the browser.
- What does done look like? Written findings, a list of what changed, and a way for you to check it.
Access and ownership, before any money moves:
- Connect the project to GitHub yourself. Lovable creates a private repository under your account, and changes sync both ways. Invite the developer to that repository.
- Invite them to your Supabase project as a member, or add them as a collaborator in Lovable if the app runs on Lovable Cloud. Never send the secret key over chat.
- Put in writing that you own the code they write. Lovable's terms say you own what you create, and that should not change when a contractor touches it.
- Agree that you receive the findings and handover notes even if you later hire someone else.
Money and time. A check or audit is $49–$800 and takes a day to a week. A single fix is €99–$990 and about two days. A cleanup that gets the app ready for real users is $1,500–$15,000 over one to eight weeks. See pricing.
Walk away if they ask for your password, want the repository or database moved into their account, quote a rebuild without reading anything, or refuse to put code ownership in writing. Get help picking when the app already has paying users. Then the first hire is an audit, and the audit tells you who to hire next. The directory and our Lovable guide are the next stops.
Check these
The code lives in a Git repository you own
Connect GitHub or export the project. If the builder account is lost, the product should not be.
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
One user cannot open another user's records
Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result.
Paid accounts are unlocked by a verified payment webhook
Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page.
Top-rated companies for Lovable apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Related questions
Should I only hire a certified Lovable expert?
No. Certification shows they have shipped Lovable projects, which is useful. The questions above matter more, and a strong React and Supabase developer without the badge will answer them well.
What should I send a developer before the first call?
The GitHub repository link, which backend the app uses, Lovable Cloud or your own Supabase, a list of what breaks and when, and screenshots of any error. Not your password and not your keys.
Sources: Lovable: Expert program; Lovable blog: Introducing the Lovable Partner Program; Lovable docs: GitHub integration; dev.to: How to vet a developer to fix your vibe coded app.