Sign-in, already wired.
Accounts are the thing that turns a demo into an app, and the thing that most first projects get wrong. Yours arrives connected to the database, with the rules already switched on.
The parts people usually forget.
Not just a login form — the session handling, the user list, and the rule that stops one customer reading another customer’s rows.
Email and Google, day one
Magic links or passwords, plus Google. Users land in a real table you can query and join against.
Rows locked by default
A new table is closed until you say who can read it. The safe setting is the one you get without doing anything.
Sessions handled properly
HTTP-only cookies, rotation, and revocation from the console when someone loses a laptop.
The mistake that leaks a whole database.
Roughly one in ten AI-generated apps ships with its data rules missing or misconfigured, which quietly makes every row public. It happens because the rules are a separate step in a separate dashboard that nobody remembers to do.
- Closed until you open it. Tables deny reads until a rule exists.
- Warned before you ship. A public table blocks the deploy and tells you which one.
- Tested from the client. The console queries as a real signed-in user, not as the owner.
Give the thing you built a real home.
A project with hosting, a database, sign-in and storage from the first minute — for $20.