Is my Lovable app secure?
A practical checklist for Lovable apps on Supabase: leaked keys, RLS, .env exposure, and what a free passive scan can catch.
Lovable ships full-stack apps fast, usually with a Supabase backend. The speed is the point — and so is the risk. The same failure modes show up again and again.
What usually goes wrong
- Supabase
service_rolekey in the frontend. That key bypasses Row Level Security. If it is in your bundle, anyone can read and write your database. - RLS off or too open. Tracked as CVE-2025-48757. One 2025 scan found inadequate RLS on 170 of 1,645 Lovable projects (researcher's statement). Lovable disputes the CVE framing; the misconfiguration risk is still real.
- Secret API keys in client code (OpenAI, Stripe
sk_live_, etc.). - Public
/.envor/.giton the deployed host.
2-minute self-check
- Open your live site → DevTools → Network → reload → search responses for
service_role,sk-,sk_live_. - Visit
https://your-app/.envand/.git/HEAD. Both should 404. - In Supabase → Advisors → Security Advisor, fix every red item.
Copy-paste into your AI builder
Audit this Lovable + Supabase app for security. 1) Remove any service_role key from client code; use the anon key only in the browser. 2) Enable RLS on every table with policies based on auth.uid(). 3) Move OpenAI/Stripe secret calls into Edge Functions. 4) Confirm .env is not in the public folder.
Related: Enable Supabase RLS · Exposed service_role key · Lovable checklist
Scan your app free
Paste your URL. ShipLatch checks for leaked keys, exposed /.env and /.git, and flags Supabase/Firebase so you know what to lock down.