Can I restrict who can access my published app?

By default, published apps are public. To restrict access, add authentication (login page) using Supabase email/password or Google OAuth. Business/Enterprise plans offer workspace-only publishing—restrict access to workspace members only. Alternatively, deploy to a custom domain and use network-level access controls outside Lovable.