Skip to content

A Lovable Prototype Turned Into a Rental Platform Ready for Real Tenants

We took a founder-built Lovable prototype for mid-term rentals and made it secure, fast and production-ready in 6 weeks, without starting from scratch.

unlockit-proto.lovable.app/listing?id=42
UnlockitHomeListingsLogin
apartment_photo_final(2).jpg

T2 Alfama RIVER VIEW!!! (furnished) - ideal for nomads

€NaN / month

undefined m² · undefined bedrooms

Loading amenities...

Contact the landlord

To reserve, pay the deposit by bank transfer. The landlord will send the IBAN in the chat.

ApplyMessage
Something went wrong. Cannot read properties of undefined (reading 'price')
Edit with Lovable
unlockit.io/lisboa/alfama-t2-river-view
Lisbon · Oct → MarFor landlordsLB
1 / 14

T2 in Alfama with river view

2 bed1 bath68 m²Alfama, Lisboa

Marta S. · ID-verified landlord · usually replies within 2 hours

Fibre 1 GbpsDesk + monitorWasherA/CLift

€1,450 / month

From 1 Oct · 1–6 months

Deposit €2,900 · bills included up to €80

ApplyBook a video tour
Client
Unlockit
Location
Lisbon, Portugal
Duration
6 weeks
Team
3 people: tech lead, full-stack dev, QA
Built with
ReactSupabasePostgreSQLStripe ConnectVercelSentry
prototype to launch
6 weeksprototype to launch
page load
1.2spage load
critical security issues
0critical security issues
active listings three months later
486active listings three months later

01 · About the client

Unlockit is a pre-seed Lisbon startup connecting remote workers and relocating professionals with furnished apartments for one to six months. The solo, non-technical founder built the first version with Lovable in a few weekends and signed up 60 landlords. Early users liked the idea, but the app broke often, loaded slowly and had no real payment flow. With an accelerator demo day approaching, the product needed to be ready for paying tenants.

02 · The problem

  • 01

    Security gaps.

    Database rules were open, so any logged-in user could read other users' data.

  • 02

    Slow and fragile.

    Pages took seven seconds to load, and many features failed under real data.

  • 03

    No payments.

    Deposits and rent were collected by bank transfer outside the app.

  • 04

    Tight deadline.

    Demo day was eight weeks away, leaving no time for a rebuild.

03 · Our solution

We audited the prototype and kept everything that worked: the design, the core flows and the founder's momentum. We then fixed what AI-generated code typically misses. We locked down Supabase row-level security, restructured the database, added indexing and image optimisation, and replaced fragile generated components with tested ones. We built a proper application and booking flow with ID verification, and added Stripe Connect so tenants pay deposits and rent in the app while landlords receive payouts automatically. We set up monitoring, automated tests and a deployment pipeline, then handed over a codebase the founder's future team can build on.

04 · What we built

  • Security hardening

    Row-level security, role-based access and secure file storage.

  • Performance work

    Query optimisation, image CDN and caching.

  • Tenant applications

    Verified profiles, documents and landlord approval flow.

  • Payments

    Deposits and monthly rent through Stripe Connect with landlord payouts.

  • Monitoring and tests

    Error tracking, uptime alerts and an automated test suite.

Built a prototype with AI? Let's make it ready for real users.

05 · Challenges we solved

  1. 1

    Rescue, not rewrite

    We kept around 60% of the original code and rebuilt only what was unsafe or unstable.

  2. 2

    Live data

    Real landlords were already using the app, so we migrated data with zero downtime.

  3. 3

    Founder handover

    We documented the codebase and trained the founder to ship small changes safely.

06 · Our approach

  1. Week 1

    01 Audit

    Full code, security and performance review with a clear fix list.

  2. Weeks 2–3

    02 Stabilise

    Security fixes, database restructure and performance work.

  3. Weeks 4–5

    03 Complete

    Applications, payments and landlord payouts.

  4. Week 6

    04 Launch

    Testing, monitoring setup and public launch before demo day.

07 · Results

The founder presented a live product with real paying tenants at demo day and raised a pre-seed round shortly after. The platform now handles hundreds of listings and applications a week without breaking, and the codebase is ready for the first in-house hire.

Inside the product. 

Key screens from the build. Click any screen to enlarge.

Before/after comparison of the listing page

unlockit-proto.lovable.app/listing?id=42
UnlockitHomeListingsLogin
apartment_photo_final(2).jpg

T2 Alfama RIVER VIEW!!! (furnished) - ideal for nomads

€NaN / month

undefined m² · undefined bedrooms

Loading amenities...

Contact the landlord

To reserve, pay the deposit by bank transfer. The landlord will send the IBAN in the chat.

ApplyMessage
Something went wrong. Cannot read properties of undefined (reading 'price')
Edit with Lovable
unlockit.io/lisboa/alfama-t2-river-view
Lisbon · Oct → MarFor landlordsLB
1 / 14

T2 in Alfama with river view

2 bed1 bath68 m²Alfama, Lisboa

Marta S. · ID-verified landlord · usually replies within 2 hours

Fibre 1 GbpsDesk + monitorWasherA/CLift

€1,450 / month

From 1 Oct · 1–6 months

Deposit €2,900 · bills included up to €80

ApplyBook a video tour
01Before/after comparison of the listing page

Tenant application flow with document upload

unlockit.io/apply/LX-2291/documents
/Application · T2 in Alfama with river viewSaved 12s agoLB
Profile
ID check
3Documents
4Deposit & sign

Upload your documents

Shared only with Marta S. for this application. PDF, JPG or PNG, up to 10 MB each.

Drag files here or browseor take a photo on your phone

Passport1.2 MB

Lukas_Becker_passport.pdf

Matched to selfie · Stripe Identity

Verified

Employment contract840 KB

Contract_Nordwind_GmbH.pdf

Employer: Nordwind GmbH, Berlin

Uploaded

Last 3 payslips2.4 MB

payslips_jul-sep_2026.pdf

64%

Guarantor letter

Optional · speeds up approval

Add file
Income check passed: €5,800 / month is above 3× rent (€4,350)
BackStep 3 of 4Continue

T2 in Alfama with river view

Marta S. · verified landlord · replies in ~2h

1 Oct 2026 → 31 Mar 20276 mo

Monthly rent€1,450.00

Deposit (2 months)€2,900.00

Unlockit service fee€145.00

Due on approval€4,495.00

You'll only be charged if Marta approves your application. Documents are deleted 30 days after the tenancy ends. Privacy

02Tenant application flow with document upload

Landlord dashboard with payouts

unlockit.io/landlord/payouts
Hosts

Payouts

Stripe Connect · Millennium bcp PT50 •••• 4471 · paid on the 3rd

Statements

Next payout · 3 Oct

€7,160.30

Oct rent, 5 units

Rent collected · Sep

€7,420.00

5 of 5 paid

Occupancy

5 / 6

Arroios T1 free from 1 Nov

Deposits held

€14,840.00

by Stripe, per tenancy

Net payouts · 2026RentDeposit release
Next payout breakdown3 Oct

Rent collected (5 units)€7,420.00

Unlockit fee 3%−€222.60

Stripe processing−€37.10

To your bank€7,160.30

SEPA · arrives 1–2 business days

DatePayoutDescriptionGrossFeesNetStatus
3 Oct 2026po_1QcT8vKx2ROctober rent€7,420.00−€259.70€7,160.30Scheduled
3 Sep 2026po_1Q4mZ3Kx2RSeptember rent€7,420.00−€259.70€7,160.30Paid
3 Aug 2026po_1PwY0aKx2RAugust rent€7,420.00−€259.70€7,160.30Paid
22 Jul 2026po_1PpE7dKx2RDeposit release€2,300.00€0.00€2,300.00Paid
3 Jul 2026po_1PhR2nKx2RJuly rent€6,270.00−€219.45€6,050.55Paid
3 Jun 2026po_1PZk4sKx2RJune rent€5,222.80−€182.80€5,040.00Paid
03Landlord dashboard with payouts

Security audit tracked as issues: 31 found, 30 fixed before launch

linear.app/unlockit/project/launch-security-audit-5f1c/issues
Projects›Launch security auditOverviewIssuesUpdatesGroup: Priority
Urgent44 of 4 done
UNL-112RLS disabled on profiles, applicationssecurity14 AugRM
UNL-113service_role key shipped in client bundlesecurity12 AugRM
UNL-114Public bucket tenant-docs exposes IDs and payslipssecurity15 AugAF
UNL-118Tenants can update listings.price through the REST APIsecurity19 AugRM
High88 of 8 done
UNL-121Stripe webhook signature not verifiedsecurity28 AugAF
UNL-122No rate limit on magic-link sign-insecurity26 AugAF
UNL-124Landlord can read other landlords' applicantssecurity21 AugRM
UNL-128Password reset tokens never expiresecurity2 SepJT
UNL-129/admin routes reachable without role checksecurity27 AugRM
UNL-125Applicant PII logged to browser consolesecurity24 AugAF
UNL-126Deposit amount trusted from client on checkoutsecurity29 AugAF
Medium1111 of 11 done
Low87 of 8 done

Progress

30 / 31

1 won't fix (low)

StatusCompleted
LeadRui Matos
Start9 Aug 2026
Target18 Sep 2026

Description

Week 1 audit of the Lovable prototype. Re-test on 18 Sep before demo day: 0 critical open, listing page LCP 7.0s → 1.2s.

04Security audit tracked as issues: 31 found, 30 fixed before launch

Unlockit's website today: unlockit.io

Unlockit website home page
05Unlockit's website today: unlockit.io

Related work. 

Get in touch

Built a prototype with AI? Let's make it ready for real users.

Share a few lines about your idea, workflow or project. A senior lead replies within one business day.

  • Free 30-minute strategy call
  • NDA on request
  • Proposal within 48 hours

We reply within one business day. No spam, ever.

The right conversation can save you
six months.

Free 30-minute strategy call · NDA on request · Proposal within 48 hours