48 of 100 — copy any prompt into Lovable, or read the guide.
Turn on Lovable's built-in backend — Postgres, auth, storage, edge functions — with zero external accounts.
Never store role on the profile table. Use a dedicated user_roles table + has_role() SECURITY DEFINER function to prevent privilege escalation.
Edge Functions are for webhooks, cron, and public HTTP endpoints. For app-internal RPC use TanStack server functions instead.
Every CREATE TABLE in public must be followed by GRANTs before ENABLE RLS — otherwise the API returns permission errors even with policies in place.
The first cause of slow Lovable Cloud pages is a missing index on the query's filter/order columns.
Cloud → Advanced settings → Export data gives you a downloadable dump when you need it.
Store document embeddings in pgvector and retrieve top-k chunks for a chat prompt.
Match model to task: Flash for cheap/fast, Pro for reasoning, image models for pixels.
Set per-user daily caps and short-circuit before calling the model.
Treat all model output and all retrieved content as untrusted input.
Ship a small eval set before iterating on prompts — otherwise you're guessing.
Use the built-in `_authenticated/` layout — never gate in a loader on a public route.
Verify the signature, use raw body, respond fast, be idempotent.
Turn on automatic tax so you stop calculating VAT/GST/sales tax by hand.
Paddle handles global tax for you — trade lower control for zero tax paperwork.
Every route sets its own title, description, og:title, og:description via head().
Put canonical only on leaf routes and self-reference the page.
A wildcard Disallow: / blocks the whole site — probably not what you want.
Title <60 chars with the primary keyword; description <160 chars.
Every meaningful image has descriptive alt; decorative images use alt="".
Every generated page needs ≥300 words of unique content or Google will penalize the domain.
summary_large_image for content pages; verify with Twitter's card validator.
Preserve link equity when you rename a URL.
Transactional and auth email from your own domain, branded.
DKIM + SPF + DMARC or Gmail drops you in spam.
Author templates in one place, render with typed props.
Use mail-tester.com before you press send at scale.
Send yourself an email and check headers before a launch.
Connect the project to GitHub before you push production.
Expose a Zapier polling endpoint or webhook trigger.
Let customers register their own webhook URL and receive events.
Never hardcode colors — declare tokens and let Tailwind utilities read them.
Use Motion for enter/exit animations; keep durations short (150–250ms).
Skip the purple-gradient-on-white, two-CTA, three-feature-grid trap.
Ship one icon set. Mixing icon libraries makes the UI look pasted-together.
One display face + one text face is almost always enough.
Glass cards work over rich backdrops; on flat surfaces they look like a bug.
Contrast ≥ 4.5:1 for text; interactive elements need a visible focus ring.
Design mobile-first; add breakpoints only where the layout actually changes.
Click Publish in the top-right; your app goes live at `<name>.lovable.app`.
Use project--<id>.lovable.app for webhooks — it never changes on rename.
Connect the project to GitHub before you accept contributors.
Set a budget and enforce it in CI or it will slip.
Wire an error boundary and a client error reporter before launch.
Long-cache hashed assets; short-cache HTML.
Publish is instant — so is reverting.
Public, unlisted, or password-gated — pick per environment.
Ten things to verify before you tweet.