ShipSnifferWhat a Lovable app looks like from the outside
Lovable generates a React + Vite frontend and, when you need a backend, connects Supabase for auth, database, storage and Edge Functions. That's a solid stack. But it means your security depends on a few specific things that the editor won't always get right, especially after many rounds of "fix this error" prompts.
From the outside, an attacker sees your JavaScript bundle (including anything prefixed VITE_), your Supabase project URL and anon key, and whatever headers your hosting sends. This check looks at exactly that surface.
The four things to check before launching a Lovable app
1. No secret keys in the bundle. Lovable's recommended pattern is to store API keys as Supabase secrets and call them from an Edge Function. Problems start when a key gets pasted into a component or a VITE_ variable to make a quick demo work. This scanner checks for OpenAI, Anthropic, Stripe, AWS, GitHub and other key formats, plus a Supabase service_role key, which must never be in the frontend.
2. Row Level Security on every table. Your Supabase anon key will be in the bundle, and that is normal. It also means anyone can query your tables directly with it. Lovable usually enables RLS on the tables it creates, but tables added by hand in the Supabase dashboard, or policies loosened to fix a "permission denied" error, are common gaps. Check the Supabase RLS checker guide for the SQL to confirm.
3. Edge Functions that check who is calling. A function that calls OpenAI or sends email using your secret is a public endpoint. Make sure it validates the user's JWT and rate-limits requests, or someone can run up your bill without ever opening your app.
4. Security headers. Apps on Lovable hosting and on many custom-domain setups ship without a Content-Security-Policy or clickjacking protection. If you deploy elsewhere (Vercel, Netlify, Cloudflare Pages), you can add them in that host's config. See the security headers checker for snippets.
Prompts to paste into Lovable
- "Review my project for any API keys or secrets used in frontend code. Move each one into a Supabase secret and call it from an Edge Function that verifies the user's JWT."
- "List every Supabase table and confirm Row Level Security is enabled. Write policies so users can only read and change their own rows, and show me any policy that uses true."
- "Check my storage buckets. Make user-upload buckets private and add policies so users can only access files in their own folder."
- "Add rate limiting and authentication checks to every Edge Function that calls a paid API."
Don't forget launch polish
Security is the part that hurts most when it goes wrong, but launch-day traffic is decided by smaller things: Open Graph tags so your link has a preview on X and Discord, a meta description, a favicon, a sitemap and working internal links. The full ShipSniffer scan checks those too and hands you a fix prompt for each, so you can go back to Lovable and fix everything in one session. Use the launch checklist to cover what no scanner can see.
ShipSniffer is an independent tool and is not affiliated with Lovable.