Your app works. You clicked through it, it looks great, and you're ready to post the link. Before you do, spend 15 minutes on the checks below. They catch the problems that actually hurt new apps: strangers reading your users' info, someone running up your bills, and a link that looks broken when people share it.
You don't need to read code for any of this.
1. Run Lovable's own security scan
Lovable runs a quick security scan every time you open the Publish window. Look at the line that tells you how many issues it found. If it says anything other than "No security issues found", click it and read each finding.
Lovable also has a deeper scan. Open your project, go to More → Security, and run the Deep security scan. It takes a few minutes. Do it at least once before a public launch, and again after big changes.
Lovable's own docs say these scans don't prove your app is secure. They're a strong first step, not the last one.
2. Check that your data is locked
Most Lovable apps store their data in Supabase, either through Lovable Cloud or a Supabase project you connected. Each table in your database (users, orders, messages, and so on) needs a lock turned on so strangers can't read it. In Supabase this lock is called Row Level Security, or RLS.
To check it:
- If you use Lovable Cloud, the quick scan from step 1 already checks your database rules. Fix anything it flags about database access or RLS.
- If you connected your own Supabase project, log in at supabase.com, open the project, and go to the Table Editor.
- Look for a red Unrestricted label next to any table. That label means anyone on the internet can read or change that table.
- In the left menu, open Advisors → Security Advisor and read anything marked as an error.
If a table is open, tell Lovable: "Turn on Row Level Security for the [table name] table and add policies so users can only see their own rows." Then check the label again.
3. Make sure no secret keys are in your app
Some keys are meant to be public, like the Supabase "anon" or "publishable" key. Others must never reach the browser: your OpenAI key, your Stripe secret key (it starts with sk_live_), or your Supabase service role or secret key.
If you ever pasted one of those straight into the Lovable chat and asked it to "just make it work", ask Lovable: "Is any secret API key used in the frontend code? Move every secret key into a Supabase Edge Function secret and call it from there." If a secret key was ever public, make a new one in that service's dashboard and delete the old one.
4. Sign up as a stranger
Open a private browser window. Create a fresh account with a different email. Then try to see things that belong to your first account: another user's profile, orders, or messages. Try changing the number or ID at the end of a URL.
If you can see someone else's stuff, your users can too. Describe exactly what you saw to Lovable and ask it to fix the access rules.
5. Check how your link looks when shared
Paste your link into a message to yourself. Does it show a title, a short description, and an image? If it shows "Vite + React" or a blank card, ask Lovable to "add a page title, meta description, and Open Graph image for the homepage."
Also make sure you're sharing your real address (your own domain or your .lovable.app address), not a preview link.
6. Know who to call
Add a simple way for people to reach you, like a contact form or email. Early users will find bugs. You want them to tell you, not post about it.
The short version
- Lovable's security scan says no critical issues
- No table in Supabase says "Unrestricted"
- No secret keys in the app
- A second account can't see the first account's data
- The link shows a proper preview when shared
If all five are true, you're in good shape to launch.