Connect a Lovable app

Create a login for the walker

Open your published app and sign up with a fresh email you control, for example walker@yourdomain.com. Give FixWalk that email and password on the connections screen. The walker uses this account so it can walk past onboarding and re-walk the same account after a fix. Nothing it does happens under your account or a customer's.

Link your repo

In Lovable, open the project, then Settings → GitHub. Connect your GitHub account and choose the repository Lovable syncs to; Lovable keeps it in sync on every edit. Back on FixWalk's connections screen, pick that repository. FixWalk only reads it.

Give the walker a read-only database key

Read-only, always. We store it encrypted, use it only during a walk, and delete it the moment you disconnect. The walker writes only under its own account, never yours.

Lovable apps keep their data in Supabase. In the Supabase dashboard for your project, open SQL Editor → New query, paste this, and run it (choose your own long password):

create role fixwalk_reader login password 'CHOOSE-A-LONG-PASSWORD' noinherit;
grant usage on schema public to fixwalk_reader;
grant select on all tables in schema public to fixwalk_reader;
alter default privileges in schema public grant select on tables to fixwalk_reader;
grant authenticated to fixwalk_reader;

Then open Project Settings → Database → Connection string and pick Session pooler. Copy the URI, replace the user postgres.<project-ref> with fixwalk_reader.<project-ref>, replace the password with the one you chose, and paste the result on FixWalk's connections screen. This role can only read. It cannot insert, update or delete anything.

The last line is what lets the walker see the tables your app protects with row-level security. Those tables return no rows at all to a plain reader, so the walker asks the database to read them as its own signed-in account — never yours and never a customer's — and only inside a transaction that is rolled back when the query ends. Leave the line out if you would rather it did not: the walk still runs, reads those tables through your app's own screens and exports instead, and the report says which tables it read directly and which it read through the app.