Security Scanner for
Lovable Sites

Lovable ships your app fast — but generated code often leaves secrets in the client bundle, Supabase tables without Row Level Security, and security headers missing entirely. Paste your Lovable URL and we'll run a live scan to show exactly what's exposed.

• Exposed API keys & secrets in your published bundle
• Supabase Row Level Security (RLS) left disabled
• Missing security headers (CSP, HSTS, X-Frame-Options)
• Publicly reachable .env and other sensitive files
• Privacy policy & GDPR gaps that trigger fines