Lovable Builds Real-Time Service to Manage Data Access Permissions in One Place

At a glance

AI app builder Lovable built its own real-time service that updates data shown on screen, replacing the previous approach. The key change is that who can see which data is now set in one central place.

Key points

1. 1

   Previously, the user's browser received the entire document, so it was hard to tell what information would be exposed even when one field was added.

2. 2

   The new service blocks fields the user lacks permission for before they leave the server, and cuts the connection mid-session if permission is revoked.

3. 3

   The service can use data from two databases, Firestore and Spanner, and sends only changed results, greatly reducing the amount of data transmitted.

4. 4

   Lovable rolled it out to real users gradually, from 1% to 100% over several days, and said no incidents affecting users occurred during this process.

Why it matters

In services where many people share data, one mistake can expose someone else's information, so the change in how access permissions are managed is important.