Guide Lovable
Lovable security audit: what it should cover, and what it costs
Short answer
PatchAndShip checks a Lovable app's Supabase Row Level Security on every table, its storage bucket policies, and its built JavaScript and repo history for exposed secret keys. Then it fixes those issues. Security Fix is $149 fixed. Fix & Deploy is $249 and also deploys the app to Vercel, Netlify or Lovable hosting with your domain. Security Fix: every critical issue on our checklist fixed within 48 hours of working access. Fix & Deploy: fixed and live on your host within 48 hours. Otherwise, a full refund if you ask within 14 days of purchase.
What a Lovable security audit should check
- RLS on every public table, one policy per operation, owner-scoped
- Logged-out test (on paid plans we run it with only your public key, before and after the fixes) and a two-account test you can run yourself
- Storage buckets: public vs private, who can list
- Secret keys (
sb_secret_/service_role) in the bundle and git history. The anon/publishable key is meant to be public - Lovable Cloud vs your own Supabase: on Lovable Cloud we run the logged-out test when the project URL and public key are visible in the built app. Otherwise we check the policies directly
Audit report vs audit + fix
A report lists problems and you fix them. Security Fix delivers the fixes as code changes and SQL migrations (as a pull request you can review if your project syncs to GitHub), and a human engineer reviews and approves every change before anything reaches production.
What it costs at PatchAndShip
| Plan | Price |
|---|---|
| Security Fix | $149 |
| Fix & Deploy | $249 |
| Launch Pack add-on | $149 once or $99 a month (not covered by the 48-hour guarantee) |
Access we need
Least privilege, no passwords, revoke at handoff.
What it is not
Not a penetration test, a security guarantee or a compliance certification. No new features. One app, one Supabase project and one deploy target per order; apps with more than 25 user-defined tables are declined or quoted separately.
Start free
FAQ
How much does a Lovable security audit cost?
At PatchAndShip, the Security Fix is $149 fixed and includes the fixes, not just a report. $249 with deployment (Fix & Deploy).
How long does it take?
48 hours from when working access is confirmed. The clock pauses while we're waiting on you.
Isn't Lovable's built-in security scan enough?
It's the right first step, and running the Quick and Deep scans is free. Lovable says its built-in scanners "perform static analysis by reading your code and configuration", and that its security tools "do not replace a thorough security review." We also test from outside: we read your tables signed out with only the public key, the way a stranger would, before and after the fixes.
Do you need my password?
No. We never ask for passwords.
What if you can't fix it?
If we don't fix every critical issue on our checklist within 48 hours of working access (and, with Fix & Deploy, get your app live on your host), you get a full refund if you ask within 14 days of purchase. The Launch Pack isn't covered.