free, no GitHub, no sign-up
Is my Lovable app secure? Paste its address.
A 20-second outside check for apps built with Lovable, Bolt, v0 or Cursor: secret keys in your JavaScript, your Supabase setup, https and security headers. It reads what any visitor's browser downloads and stores nothing.
What this checks
- Secret keys shipped in your JavaScript: Supabase service role, Stripe, OpenAI and other API keys
- Which Supabase key your site uses, and whether it is the public one
- Whether the site also loads without https
- Security headers and login cookies
- Source code published with the site
What it can't see
Whether strangers can read your tables, call your server functions or fake a payment. Those are decided in the code and in your Supabase policies, which is where the serious problems in our study were. The free code scan checks them.
Questions
- Is my Lovable app secure?
- This free check looks at what anyone can see from the outside: keys in your JavaScript, https and security headers. The problems that leak data, like tables strangers can read or server functions anyone can call, are decided by your code and your Supabase policies. The free code scan checks those.
- Do I need GitHub for this?
- Not for this check: the address is enough. For the code scan you can paste a public GitHub link, connect GitHub to pick a private repository (read-only), or upload a zip of your project.
- Does it attack or change my site?
- No. It downloads the same home page and JavaScript files any visitor's browser does, reads the response headers, and stops. It does not log in, send forms, look for hidden files or touch your database, and nothing is stored.
- My Supabase anon or publishable key showed up. Is that bad?
- No, that key is meant to be public and is in every Supabase website. What matters is your row level security: without it, anyone with that key can read and change your tables. A service role or secret key in the website is critical, because it skips row level security.
- Lovable already has a security scan. Why use this?
- Use both. Lovable's scan builds on the Supabase Security Advisor, which mainly checks whether row level security is turned on. A policy like using (true) passes that check and still opens the table to everyone. Redproof reads what each policy actually allows.