Lovable security check

Why Lovable apps share the same few gaps

Most Lovable apps use Supabase as the backend. To talk to it from the browser, your app ships the Supabase URL and the public anon key in its frontend code. That's by design, but it means anyone can send requests to your database with that key. Row Level Security policies on each table decide what they get back.

The other common slips are pasting a secret API key straight into the frontend and launching without basic security headers.

What the free scan checks

• Leaked keys in your frontend

  Your page HTML and up to 15 of your own JavaScript files are checked for Stripe secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.

• Supabase service_role key

  If a Supabase service_role key is in your client code, that is flagged as critical. That key skips Row Level Security entirely.

• Supabase URL and anon key

  Lovable apps usually ship these to the browser, which is normal. We flag it so you know Row Level Security is what protects your data.

• Open tables (owner opt-in)

  Tick the extra box and we ask a list of common table names (like profiles, users, orders) for 1 row using your public anon key. Row contents are never stored or shown.

• Files left on the server

  Things like /.env, /.git/config, backup files, package.json and lockfiles, and public source maps.

• Security headers and CORS

  HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.

7 step pre-launch checklist

1. Open your app logged out. Use a private window. Anything you can see there, anyone can see.
2. Run Security Advisor in Supabase. Fix anything flagged "RLS Disabled in Public".
3. Write policies for every table. Restrict reads and writes to the owning user, for example auth.uid() = user_id.
4. Keep secret keys server-side. Only publishable keys (Supabase anon, Stripe pk_) belong in the browser. Call paid APIs from an Edge Function.
5. Test with a second account. Sign up as a new user and make sure you can't see the first user's data.
6. Add security headers. Set them in your host config, starting with HSTS and a Content-Security-Policy.
7. Scan before you share the link. Run the free scan below and fix anything critical or high first.

FAQ

Is Lovable secure?

Lovable gives you a solid starting point, but your app's safety depends on how your Supabase tables, keys and hosting are set up. That part is on you, which is what this check helps with.

Do I need to sign up?

No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.

What does it cost?

The scan and your score are free. The full list of findings with a fix prompt for each is a one-time $9, or $29 for a pack of 10 reports.

Does it attack my site?

No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.

What doesn't it check?

Pages behind a login, your Supabase policies directly, and third-party scripts. A good score is not a guarantee of security.

Is this a pentest?

No. It's a quick automated check for the most common, most expensive mistakes.