Lovable app security check: the 7 things to verify before launch
· PlugLeak
A practical security checklist for apps built with Lovable (and Bolt or v0): leaked keys, Supabase RLS, .env exposure, headers and SSL — plus a free automated check.
Lovable, Bolt and v0 make it possible to ship a real app in an afternoon. The catch: the code runs in your users' browsers, and anything in that code is public. Here is the checklist we'd run before sharing a Lovable app with the world.
1. No secret keys in the frontend
Search your live site's JavaScript for sk_live_ (Stripe), sk- (OpenAI), sk-ant- (Anthropic), AKIA (AWS) and -----BEGIN (private keys). Publishable keys like Stripe pk_live_ are fine; secret keys are not. Calls that need a secret key belong in a Supabase Edge Function.
2. The Supabase key in your app is the anon key
Lovable apps usually talk to Supabase directly from the browser using the anon key. That's by design — as long as it's not the service_role key. See our service_role guide.
3. RLS is on for every table
With the anon key public, Row Level Security is the only thing standing between strangers and your data. In Supabase → Table Editor, every table should show RLS enabled, with policies that scope rows to auth.uid(). Test it: log in as user A and try to load user B's records.
4. No public .env or .git
Visit https://your-app/.env and https://your-app/.git/config. You should get a 404 or your normal app page — never a file full of KEY=value lines.
5. Security headers
At minimum: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff and Referrer-Policy. If you host on Vercel or Netlify you can add them in vercel.json / _headers.
6. HTTPS everywhere, certificate healthy
HTTP should redirect to HTTPS, and your certificate shouldn't be close to expiry (custom domains sometimes fail to renew).
7. Re-check after every change
The sneaky part of AI building: a later prompt ("add a payments page") can reintroduce a key or remove a header. Re-run these checks after each meaningful deploy.
Our free scan automates checks 1, 2, 4, 5 and 6 from the outside. Check 3 (RLS) needs owner verification — that's coming soon. How the free scan works lists every request it makes and everything it skips, including that it does not test RLS.
Check your app now — free, passive, about 20 seconds.
Same scanner as the homepage scan. Paste the live URL. It reads what a visitor already downloads. It does not log in or query your database.