Security check for a booking app built the way Lovable and Bolt build them (React and Supabase), written for the owner, not for engineers. The app is a demo with ten planted holes that real AI-built apps ship with. A read-only check found 9 issues, 4 of them critical: anyone could read every customer's booking, the admin screen sent the secret database key to the browser, and a customer could make themselves an admin. Each finding has one plain sentence of risk, masked evidence and a copy-paste fix. After the fixes, a re-check shows all 9 fixed.