Is my Lovable app secure? A 5-minute check
Lovable makes it easy to ship a full app in an afternoon. The catch is that the AI wires up Supabase and third-party APIs for you, and it doesn't always lock them down. Here are the three things to check before real users sign up.
1. Row-level security on every Supabase table
Your Supabase anon key is meant to be public, and it ships in your frontend. That is fine only if every table has row-level security (RLS) turned on with sensible policies. Without RLS, anyone who opens your site can read, and often write, every row.
In the Supabase dashboard, open Table Editor and look for tables marked "RLS disabled" or "Unrestricted". Turn RLS on and add a policy that limits rows to their owner, for example auth.uid() = user_id.
2. No secret keys in the browser
Open your live site, press F12, go to Sources and search the JavaScript for sk-, sk_live_, service_role or AKIA. Any match is a secret key every visitor can copy. Move that call into a Supabase Edge Function or another server route, and rotate the key.
3. Nothing sensitive in the GitHub repo
If you synced the project to GitHub, check that no .env file was committed and that no key appears in old commits. Deleting a key in a later commit does not remove it from history.
The fast way
SafeCheck runs all of these checks for you. Paste your site address or GitHub repo and you get a grade in under a minute, free.
Check your app now. Free, no signup, under a minute.
Scan your appMore guides: How to check if Supabase RLS is enabled (and fix it) · Firebase test mode rules: how to tell if your database is open · How to check if your website leaks API keys · OpenAI API key exposed in your frontend? Do this now · Security checklist for apps built with Bolt, Cursor, v0 and Replit · Is this Claude skill or MCP server safe to install? A 5-minute check