Short answer: you can keep a Lovable, v0 or Bolt dashboard private, but the built-in options only control who can open the app. They do not control which data each person sees. For a team dashboard that is often enough. For clients, you also need logins per person, row-level security in the database and someone who maintains it.
- Lovable: set website access to Invite only (Free/Pro, up to 10 people) or Workspace/Custom (Business and up).
- v0: protect the Vercel deployment with Vercel Authentication (all plans) or a password ($20 per project per month on Pro).
- Bolt: make the site private on a paid plan; custom domains must stay public.
- Per-client data needs real authentication and database rules. That is where most vibe-coded dashboards leak.
- If your data already lives in Power BI, a portal on your semantic model gives logins and per-user data out of the box.
Why vibe-coded dashboards leak
Most leaks do not come from hackers breaking in. They come from an app that was never told who may see what.
- Missing database rules. In 2025, researcher Matt Palmer found 303 endpoints across 170 Lovable-built apps without working row-level security. Anyone could read tables with emails, phone numbers, payment status and API keys using the public key in the browser. It became CVE-2025-48757, rated 9.3 (critical); Lovable disputes it, saying each customer secures its own data (timeline).
- Public by default. In May 2026, Red Access found about 380,000 publicly reachable AI-generated web apps, of which roughly 5,000 leaked data such as medical records and financial files (eWeek). Platforms say visibility is a user setting, and many users never change it.
- Keys in the frontend. A dashboard that calls your database or API directly from the browser ships its credentials to every visitor.
A dashboard is a particularly risky case. It exists to show data, it is often built fast for one meeting, and it gets forwarded.
Sharing options per tool
Each builder can put a login in front of the published app. None of them decides which rows a viewer sees; that is up to your code and database.
For an internal team dashboard, these settings are a reasonable first line. For client-facing dashboards they fall short: viewers need an account on the builder's platform, the domain is not yours, and every viewer still sees all the data the app can load.
What you have to build yourself for client dashboards
Once a dashboard goes to clients, you become the owner of an application. That means five jobs the builder does not do for you.
- Authentication. Real user accounts, password resets, SSO for larger clients, and removing access when someone leaves.
- Per-user data. Row-level security policies in the database, tested for every table. A security scan that checks whether RLS exists is not the same as checking whether it works.
- Secrets. No database or API keys in the browser. Queries run through a server or edge function.
- Hosting and compliance. A domain, a data processing agreement, a hosting region you can explain to clients, and an access log.
- Maintenance. Dependency updates, data model changes, and someone who understands the generated code when it breaks.
The metrics are a sixth, quieter problem. A vibe-coded dashboard defines revenue or margin in its own SQL. Your Power BI reports define it in the semantic model. Sooner or later the two disagree in front of a client.
The alternative: build on your semantic model, publish in a portal
If your numbers already live in Power BI, you do not need a separate app to get a custom dashboard. With DataTako data dashboards, you describe the dashboard to Claude, ChatGPT or another AI app. It builds an HTML dashboard that queries your semantic model live. You review it and publish it to your portal.
What you get without building it yourself:
- Logins on your own domain, with email and password or SSO. Viewers need no AI account and no Power BI licence.
- Row-level security on every load. Each client sees only its own rows, using the RLS roles you already have.
- No keys or copies in the browser. The dashboard queries the model through DataTako; no data is exported.
- The same measures as your reports, so revenue means the same everywhere.
- Drafts stay private until you publish, and you can preview as a specific RLS role.
The trade-off: one semantic model per dashboard, and up to 10,000 rows per query. For anything that needs its own database or write-heavy workflows, a full app builder is still the better fit.
How to choose
- A few teammates, no personal data: Lovable Invite only or Workspace, v0 with Vercel Authentication, or a private Bolt site.
- Whole company, same data for everyone: Lovable Business with Workspace access, or v0 with Passport on your identity provider.
- External clients, each with their own data: real auth plus tested row-level security, or a portal on your semantic model.
- Data already in Power BI: build on the semantic model and publish in a DataTako portal.
- Need a database, forms and custom workflows: a full app builder, with a security review before go-live.
FAQ
Can I password-protect a Lovable app? Not with a shared password. Lovable restricts published apps by login instead: Invite only on Free and Pro (up to 10 people), Workspace or Custom on Business and Enterprise.
Is a v0 dashboard private by default? New Vercel projects have Deployment Protection on by default, but check which URLs it covers. Password protection costs $20 per project per month on Pro.
Can I make a Bolt site private on my own domain? No. Sites on a custom domain can only be published publicly. Disconnect the domain to make the site private.
Does a login stop clients from seeing each other's data? No. A login decides who gets in. Row-level security in the database decides which rows each person sees. You need both.
Is Lovable's security scan enough? It helps, but it should not be your only check. In the 2025 incident, the scan checked whether RLS existed, not whether it worked. Test with a second user account before you go live.
Can clients view the dashboard without an account on Lovable, Vercel or Bolt? Only if the app is public or uses its own auth. In a DataTako portal, clients log in on your domain.
Conclusion
Vibe-coding tools make building a dashboard easy, and sharing it risky. A login is only the first step; per-client data needs database rules that someone tests and maintains. If your numbers already live in Power BI, skip the app and publish an AI-built dashboard in your DataTako portal.
