123-MPU – Security Audit of a Vibe-Coded App (Lovable & Supabase)

Starting point

123-MPU built the “MPU Manager” with Lovable and Supabase: a multi-tenant client management system handling sensitive personal data, documents and video recordings. Before go-live, the typical questions of every vibe-coded app came up:

• Is the separation between tenants truly watertight?
• Do the RLS policies actually work, or do they merely exist?
• What happens with 100 or 1,000 active users?

Solution

A technical analysis of the entire platform. At its core were 25 test cases covering:

• Multi-tenant architecture and database design
• Cross-tenant access based on the RLS policies
• Secrets and API keys
• Auth and magic-link security, storage and video access control
• API integrations (Zoom, LearningSuite, Calendly, Stripe)

This was complemented by a threat model, a scalability and cost analysis, a findings database with bug reports, and a prioritized “ship-ready” checklist with a five-phase action plan.

What generally matters when taking vibe coding to production is summarized in our security and DevOps check for AI-built software.

Technology stack

• Lovable + Supabase (Row Level Security, Storage, Edge Functions)
• Multi-tenant security testing (cross-tenant access, query manipulation, JWT validation)
• API integrations: Zoom, LearningSuite, Calendly, Stripe (webhook security)
• Threat modeling & CWE-based vulnerability analysis
• Performance & cost-structure analysis (connection pooling, rate limiting, edge functions)

Result & Impact

• 25 test cases, mostly passed
• 2 critical security vulnerabilities found and documented before go-live
• Prioritized 5-phase plan toward a “ship-ready” platform
• Hardening instead of rebuilding: by our estimate, fixing takes days, while a rebuild would have taken 2 to 4 months
• Follow-up offer for fixing the findings and integrating Stripe