Built it with Lovable? Check what it leaks.
Lovable apps usually run on Supabase, and the most common mistake is a database table that any visitor can read. The free scan shows your score and how many problems you have; the Full Scan adds the evidence, a fix prompt for each one, and the deeper checks (database, exposed files, HTTPS/TLS, email spoofing, admin panels) after you verify you own the app.
The 7 most common Lovable problems
AI or payment keys in the browser
OpenAI, Anthropic or Stripe secret keys, or the Supabase service_role key, shipped inside the JavaScript every visitor downloads. The free scan checks this.
Supabase tables anyone can read
With your public Supabase key, a stranger can read the rows of a table that has no working Row Level Security. We rate this high, and critical when the table holds personal or payment data such as users, orders or messages. We only count the rows, we never download them. Part of the Full Scan.
API routes that answer without login
A route found in your site code returns data such as emails or roles to a visitor who is not signed in. Part of the Full Scan.
Storage buckets that can be listed
Strangers can see the names of your Supabase storage buckets. Worth a look to be sure nothing private is publicly readable. Part of the Full Scan.
Outdated JavaScript libraries
An old copy of a library such as jQuery, Bootstrap, AngularJS, Lodash, Moment.js or Handlebars with a publicly known security flaw, found in your page or its JavaScript files. The free scan checks this.
Weak HTTPS or email protection
HTTP that does not redirect to HTTPS, a certificate that is about to expire (rated high if it is not trusted or already expired), a missing SPF or DMARC email record (so anyone can send email that looks like it came from your domain), or an admin login page open to the public. Public source maps are reported too, as low. Part of the Full Scan.
Missing security headers
No Content-Security-Policy, HSTS or clickjacking protection. Low risk on their own, but easy to add, and they make other bugs harder to exploit. The free scan checks these.
How to fix them in Lovable
- 01Run a free scan to see your score, then get the Full Scan for the location and a fix prompt for each red item.
- 02For each red item, copy the “Paste into Lovable” prompt into Lovable’s chat.
- 03If a key leaked, also make a new one in that service (OpenAI, Stripe, Supabase). The old one is already out there.
- 04Publish, then re-scan. Repeat until the light is green.
Doesn’t Lovable already check this?
Yes, and you should use it. Lovable’s own review looks at your project from the inside before you publish. Greenlight Scan checks the live app from the outside, the way a stranger would, and confirms the fix actually worked after you publish. Two different views, and using both is the safest.
Full comparison →Questions
Do you change anything in my app?
No. Every check is read-only. For your database we only count rows, we never download them.
Do I need to give you my Lovable login?
No. We only need your app’s public web address.
My app has a custom domain. Does that work?
Yes. Paste whichever address your visitors use.
Which checks need me to prove I own the app?
The deeper checks (database access, exposed files, API routes) run after you add a small marker to your site to show it is yours. The free preview only reads what any browser downloads.
What does the free scan check, and what needs the Full Scan?
The free scan is passive. It reads what any browser downloads and checks it for leaked keys, security headers, cookie flags, mixed content and outdated JavaScript libraries. It shows your score, how many problems of each severity were found, and the title and why-it-matters of your top problem; the evidence, location and fix are hidden. The Full Scan unlocks every finding and fix prompt, and, after you verify you own the app, adds database and storage access, exposed files such as .env or .git, API routes that answer without login, Firebase rules, HTTPS and TLS certificate checks, SPF and DMARC email protection, open admin panels and public source maps.