Small pieces of code that run on servers close to your users. In Supabase (which Lovable uses), your backend logic likely runs as edge functions. They're billed per run — missing debounce turns pennies-per-month into dollars-per-day at scale.

Configuration values stored outside your code. Also where sensitive info like API keys and passwords should live — not hardcoded. If secrets are in the code, anyone with code access has access to everything.

Keeping sensitive credentials secure and controlled. If someone gets your database password, they have your users' data. AI tools frequently put secrets in places they don't belong.

A relational database (like PostgreSQL) organizes data into structured tables — like a spreadsheet. NoSQL (like MongoDB) is more flexible. The choice matters less than whether the data is organized thoughtfully, with proper indexes and clear relationships.

A tool that lets your code talk to the database using plain language instead of raw SQL queries. Makes database interaction easier and protects against some attacks. But ORMs can hide performance problems — generating slow queries you never see.

Someone enters malicious database commands into a form field and your app accidentally executes them. A login form without protection could let an attacker dump your entire database with a single input.

Prevention: use an ORM or parameterized queries. Never build database queries by directly inserting user input.

An attacker injects malicious code into your website that runs in other users' browsers. If your app displays user-generated content without sanitizing it, that code can steal other users' session data — no password needed.