Is my Lovable app safe to launch?

Do these free checks first

1. Run Lovable's Deep scan

Open your project's Security view (in the project toolbar, choose More, then Security). The Quick scan runs automatically every time you publish. The Deep scan reviews all your app's code, takes 3 to 13 minutes according to Lovable, and doesn't run on its own, so start it yourself. Lovable says: "Both scans are free and do not consume credits."

Deal with every Critical finding before you launch. If you use "Try to fix", Lovable's own advice is to "Always review the changes Lovable makes and test them thoroughly."

A clean result is a good sign, not proof. Lovable says the scanner "cannot catch every possible risk", and its Quick and Deep scans read your code and configuration. They don't send live requests to your app. That's why steps 2 and 3 exist.

2. Open the Supabase Security Advisor

If your app is connected to your own Supabase project, open the project's Security Advisor. It "checks for common security problems". One of its errors (level ERROR) is "RLS Disabled in Public", which flags tables with RLS off that signed-out or signed-in users can read through the API. Supabase's message for it: "Anyone with your project URL can read, edit, and delete all data in this table because Row-Level Security is not enabled."

Fix every error, and as Supabase says, "Review each finding carefully before you dismiss it."

On Lovable Cloud (Lovable's built-in backend), there's no Supabase dashboard. You manage the backend in the Cloud view inside Lovable, and you can review every policy under More, then Cloud, then Database, then RLS policies. The Quick scan from step 1 also reviews your database access rules.

3. Test with a second account

The scans and the Advisor read your code and settings. A real test shows what another signed-in user can actually reach.

1. Sign up as two test users, A and B.
2. As user A, create something private, like a note or an order.
3. As user B, ask the database for A's item. With RLS working, the answer is an empty list: [].

For whoever builds the app with you, the request looks like this:

curl "https://YOUR-PROJECT.supabase.co/rest/v1/your_table?id=eq.ROW_ID" \
  -H "apikey: YOUR_PUBLISHABLE_KEY" \
  -H "Authorization: Bearer USER_B_ACCESS_TOKEN"

Two notes:

• [] only means something if A's row really exists, so check it in the Table Editor (on Lovable Cloud, in the Cloud view's Database area).
• Don't run this test in Supabase's SQL editor. By default it runs as the postgres role, which "bypasses Row Level Security", so everything looks readable there and the test proves nothing.

4. Make sure no secret key is in your app

The Supabase key in your app's code should be the publishable key (it starts with sb_publishable_) or the older anon key. Those are meant to be public. A secret key (sb_secret_) or the older service_role key must never be there. If someone told you a key is exposed, read Someone told me my Supabase key is exposed.

Where we can help

• Instant check (free, no signup): paste your URL at patchandship.com/check.html. It shows the result on screen in a few seconds. It reads your homepage only, follows up to 3 redirects, loads up to 10 of your site's own JavaScript files (never third-party scripts) and runs 5 security header checks. It looks for secret keys in that public code. It never logs in or touches your database, so it can't tell you whether your RLS works or confirm a fix. Critical and High details stay hidden until you prove you control the site with a one-time code in a .well-known file, a homepage meta tag or a DNS TXT record. Email is never accepted as proof. It doesn't store your results, page contents or any key it finds. It keeps a short log entry for up to 1 day and a hashed copy of your IP address for up to 24 hours.
• Emailed mini check (free, for app owners, or someone the owner has authorized): ask for one. We run it by hand and email you a one-page summary within 24 hours. It's also passive and runs no database queries.
• Security Fix, $149: every critical issue on our checklist fixed within 48 hours of working access. Here, critical means RLS disabled or misconfigured, public storage buckets holding private files, and exposed secret keys.
• Fix & Deploy, $249: fixed and live on your host within 48 hours. For a Lovable app, your host can be Vercel, Netlify or Lovable hosting. On Fix & Deploy, misconfigured environment variables and auth redirects also count as critical.

Otherwise, a full refund if you ask within 14 days of purchase. "Critical" and "live" are defined in our Refund Policy.

AI agents run the checks and a human engineer approves every change. It's not a penetration test, a security guarantee or a compliance certification. Details: Secure your Lovable app.

Related pages

• Lovable security checklist before you publish (8 checks)
• Check your Supabase app before launch (7 technical checks)
• Security scan keeps flagging the same issue?

Sources

• Lovable Docs, Project security view
• Supabase Docs, API keys
• Supabase Docs, Row Level Security
• Supabase Docs, Advisors
• Supabase Blog, Studio AI Assistant and User Impersonation
• Lovable Docs, Security overview
• Lovable Docs, Connect to Supabase