{"id":30864,"date":"2026-10-29T09:25:00","date_gmt":"2026-10-29T08:25:00","guid":{"rendered":"https:\/\/www.web-systems.pl\/?p=30864"},"modified":"2026-10-23T08:53:28","modified_gmt":"2026-10-23T07:53:28","slug":"lovable-app-to-production-take-over-prototype","status":"publish","type":"post","link":"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/","title":{"rendered":"Lovable App to Production: How to Take Over a Prototype"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Your Lovable prototype works: you click around and everything runs smoothly. But before a Lovable app goes to production, a team has to take over the code and the database, review security and decide whether to keep developing the prototype or build from scratch.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A working prototype proves the idea. Real customers are a different league when it comes to reliability. Vibe coding in a company, meaning building apps with natural language prompts in Lovable, Bolt and similar tools, cuts the road to a first version a lot. And that&#8217;s a good thing. I&#8217;m writing this for business owners and product managers who have a prototype like this and are looking for a team to take it further.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Where_are_the_prototypes_code_and_database_and_who_has_access_to_them\" >Where are the prototype&#8217;s code and database, and who has access to them?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#What_does_the_database_export_include_and_what_has_to_be_moved_by_hand\" >What does the database export include, and what has to be moved by hand?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Security_review_of_an_AI-generated_app_secrets_RLS_and_server_logic\" >Security review of an AI-generated app: secrets, RLS and server logic<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Checklist_before_taking_over_the_apps_code\" >Checklist before taking over the app&#8217;s code<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Extend_the_prototype_or_rebuild_the_app_from_scratch\" >Extend the prototype or rebuild the app from scratch?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#How_do_you_hand_over_an_AI_app_prototype_to_a_development_team\" >How do you hand over an AI app prototype to a development team?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Lovable_app_to_production_where_to_start\" >Lovable app to production: where to start<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Does_the_code_from_Lovable_belong_to_me_and_can_I_move_it\" >Does the code from Lovable belong to me, and can I move it?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Is_the_Lovable_database_export_enough_to_move_the_app\" >Is the Lovable database export enough to move the app?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.web-systems.pl\/en\/lovable-app-to-production-take-over-prototype\/#Is_an_app_built_in_Bolt_taken_over_the_same_way\" >Is an app built in Bolt taken over the same way?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_are_the_prototypes_code_and_database_and_who_has_access_to_them\"><\/span>Where are the prototype&#8217;s code and database, and who has access to them?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The project code lives in Lovable. You can, however, connect it to a GitHub repository with two-way sync, or download it if you&#8217;re on a paid plan. As the <a href=\"https:\/\/docs.lovable.dev\/integrations\/github\" rel=\"nofollow noopener\" target=\"_blank\">Lovable GitHub integration docs<\/a> explain, the repository created when you connect is private by default. Still, check that it sits in your company&#8217;s organization and not on the personal account of whoever clicked the prototype together.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Be careful when disconnecting the integration. Once you disconnect, syncing stops: the repository stays on GitHub, but any further changes are saved only in Lovable. That&#8217;s an easy way to end up with two versions of the code drifting apart. So before you hand over the code, agree on a single source of truth. Also list every person and account with access to Lovable, GitHub and the database. Permissions nobody needs? Revoke them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_does_the_database_export_include_and_what_has_to_be_moved_by_hand\"><\/span>What does the database export include, and what has to be moved by hand?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Under the hood, the prototype runs on PostgreSQL. According to the <a href=\"https:\/\/docs.lovable.dev\/features\/database-backups\" rel=\"nofollow noopener\" target=\"_blank\">Lovable database export docs<\/a>, the export covers the schema and the data, including user accounts. Sounds complete, but it isn&#8217;t. A working app depends on several things you won&#8217;t find in the export. You have to move these separately:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>files kept in storage, e.g. photos and documents uploaded by users,<\/li>\n<li>edge functions code, meaning functions that run on the server side,<\/li>\n<li>secrets and API keys for external services,<\/li>\n<li>login configuration and authentication providers.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Moving the backend to another provider is a job for a developer, not a single click. Put it in the plan and the budget from day one. Without these pieces, the app simply won&#8217;t start after the migration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Security_review_of_an_AI-generated_app_secrets_RLS_and_server_logic\"><\/span>Security review of an AI-generated app: secrets, RLS and server logic<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Rule number one: frontend code runs in the browser, so it can&#8217;t be in charge of security. And treat any secret that ends up in it as exposed. That&#8217;s how the <a href=\"https:\/\/docs.lovable.dev\/tips-tricks\/security-best-practices\" rel=\"nofollow noopener\" target=\"_blank\">Lovable security best practices<\/a> put it, and that&#8217;s where the review has to start. Search the frontend code for keys and tokens, revoke them and move them to the server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The second area is <strong>RLS<\/strong> (Row Level Security), the rules that decide which database records a given user can see, plus role permissions. The test question is simple: can a logged-in customer read or change someone else&#8217;s data? If so, you have a problem. Client-side validation doesn&#8217;t protect anything either. Business rules and data checks have to run on the server. We cover what <a href=\"https:\/\/www.web-systems.pl\/en\/how-to-fix-ai-generated-code-in-software-projects\/\">fixing AI-generated code<\/a> looks like in practice in a separate article.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Checklist_before_taking_over_the_apps_code\"><\/span>Checklist before taking over the app&#8217;s code<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before the team takes over the code, it goes through a few areas that usually nobody cared about in the prototype:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Ownership of the repository and database<\/strong>: the company&#8217;s organization, a list of accounts with access.<\/li>\n<li>Secrets and keys in the frontend code.<\/li>\n<li>RLS rules and role permissions.<\/li>\n<li>Logic on the server side instead of in the browser.<\/li>\n<li>Automated tests, which are usually missing.<\/li>\n<li>Backups of the database and files, and how to restore them.<\/li>\n<li>Costs of services running in the background: databases, functions, external APIs.<\/li>\n<li>Personal data: what is collected, where it goes and who can see it.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">An app that processes customer data is subject to data protection law. In the European Union that&#8217;s the GDPR, and there&#8217;s no point pretending a prototype is exempt. Background services, in turn, are a permanent part of maintaining an AI-built app. Work out the <a href=\"https:\/\/www.web-systems.pl\/en\/how-much-application-maintenance-costs-after-launch\/\">app maintenance costs<\/a> after launch right away, before the first invoice catches you off guard.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Extend_the_prototype_or_rebuild_the_app_from_scratch\"><\/span>Extend the prototype or rebuild the app from scratch?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Extend it if the code and database structure is clear and the security fixes are isolated. If you&#8217;d have to touch the foundations, it&#8217;s better to treat the prototype as a specification. What speaks for extending it? A consistent data model. Logic that can be moved to the server. And a tech stack the team feels at home with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rebuilding makes sense when the logic is smeared across the whole frontend, there&#8217;s no access control, or you plan features the current architecture can&#8217;t carry. Even then, the prototype doesn&#8217;t go in the bin. It shows flows, screens and user needs that have already proven themselves, and that&#8217;s worth a lot. On that basis you can build the <a href=\"https:\/\/www.web-systems.pl\/en\/application-mvp-build-first-version-without-burning-budget\/\">first version of the product<\/a> on solid foundations.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_do_you_hand_over_an_AI_app_prototype_to_a_development_team\"><\/span>How do you hand over an AI app prototype to a development team?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start: access to the company repository, the database export and a list of items outside the export. Finish: a joint code review. Along the way, prepare a short description of the app&#8217;s purpose, a list of the features customers actually use (not the ones that were supposed to be there), known bugs and a list of accounts and external services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The team taking over the project does the review, plans the backend migration, adds tests, sets up backups and takes on ongoing maintenance. Looking for a contractor for each of these stages? Here&#8217;s how we approach <a href=\"https:\/\/www.web-systems.pl\/en\/software-development\/\">custom software development<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Lovable_app_to_production_where_to_start\"><\/span>Lovable app to production: where to start<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A prototype built with natural language prompts is valuable proof that the idea makes sense. It doesn&#8217;t guarantee stability under the load of real users, though. First the review against the checklist, only then the decision: extend or rebuild. All in all, it comes down to three things. Taking a Lovable app to production means sorting out code ownership, security and the decision about the future architecture.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1792741780811-0\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Does_the_code_from_Lovable_belong_to_me_and_can_I_move_it\"><\/span>Does the code from Lovable belong to me, and can I move it?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>You can sync the code with a GitHub repository or download it on paid plans. Just make sure the repo sits in your company&#8217;s organization and not on the creator&#8217;s personal account. Then handing the project over to a team is basically a matter of granting permissions.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792741780811-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Is_the_Lovable_database_export_enough_to_move_the_app\"><\/span>Is the Lovable database export enough to move the app?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No. The export covers the schema, data and user accounts, but it doesn&#8217;t include files in storage, edge functions code, secrets, login settings or API keys. A developer moves those separately.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1792741780811-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Is_an_app_built_in_Bolt_taken_over_the_same_way\"><\/span>Is an app built in Bolt taken over the same way?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Generally yes, the review rules are the same: code, database, secrets, permissions and tests. Export details depend on the specific tool, so check its documentation before handing the project over.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Your Lovable prototype works: you click around and everything runs smoothly. But before a Lovable app goes to production, a team has to take over the code and the database, review security and decide whether to keep developing the prototype or build from scratch. A working prototype proves the idea. Real customers are a different [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":30859,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[836],"tags":[99,2529,2531,2532,901,2535],"class_list":["post-30864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-programming","tag-apps","tag-bolt-x","tag-lovable-x","tag-prototype","tag-security","tag-vibe-coding-x"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/comments?post=30864"}],"version-history":[{"count":2,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30864\/revisions"}],"predecessor-version":[{"id":30995,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30864\/revisions\/30995"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media\/30859"}],"wp:attachment":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media?parent=30864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/categories?post=30864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/tags?post=30864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}