Diagnosis report
SAMPLE · not a real client- App
- Studio booking app (fictional)
- Built with
- Lovable, React + Vite, Supabase
- What the owner reported
- New members say they never get in after signing up. Phone signups seem to do nothing. Two people turned up for the same class slot last week.
Verdict
Fix, don't rebuild.
The structure is sound. The problems are configuration and missing checks, not a bad foundation, so fixing costs a fraction of a rebuild.
- 01Critical
Signup confirmation links point to the old preview site
- What you see:
- New members click the email link and land on a page that doesn't exist, so they never get in.
- Why:
- Supabase Auth still has the Lovable preview address as its Site URL, and the production domain isn't on the redirect allow-list. Signup doesn't pass its own redirect address either.
- The fix:
- Set the Site URL and allow-list for production and preview, pass the redirect on signup, and test the full email flow on both.
$150
- 02Critical
Any signed-in member can read every booking
- What you see:
- Nothing visible yet. But members' names and phone numbers are readable by any other member.
- Why:
- Row-level security is switched on for the bookings table, but its read rule allows every signed-in user, so the protection does nothing.
- The fix:
- Rewrite the rules so members see only their own bookings and only studio staff see all of them. Then confirm it from a second test account.
$250
- 03High
Phone signups fail silently
- What you see:
- On a phone, the signup button spins forever. Nothing tells the person what went wrong.
- Why:
- When Supabase rejects a signup (a short password, or too many attempts), the error is thrown away and the loading state never resets.
- The fix:
- Show the real reason in plain words, reset the button, and test on iOS Safari and Android Chrome.
$200
- 04High
Two people can book the same slot
- What you see:
- Double bookings when a class is nearly full.
- Why:
- Availability is only checked in the browser. The database itself never stops a second booking for the same slot.
- The fix:
- Add a database rule that allows one booking per slot, and show a clear 'just taken' message when it's hit.
$300
- 05Medium
Refreshing any page except home gives a 404
- What you see:
- Members who refresh their bookings page, or open a shared link, get an error page.
- Why:
- The app moved off Lovable hosting, and the new host isn't told to send every route to the app.
- The fix:
- Add the host's rewrite rule and check every route after a hard refresh.
$100
- 06Low
Project keys are hard-coded in the source
- What you see:
- Nothing visible. But there's no safe way to run a test copy of the app against test data.
- Why:
- The Supabase address and public key are written into the code instead of environment settings.
- The fix:
- Move them to environment variables, so staging and production can point at separate databases.
$100
Noted, not worth paying to fix
- – Three near-identical button components. Untidy, but harmless.
- – Unused packages in the project. They add nothing to what users download.
- All items
- $1,100
- Diagnosis credited
- −$249
- To pay, 3 days
- $851