Is my Lovable app safe to launch?

What Lovable already does for you

• When you open Lovable's Publish dialog, it runs a Quick security scan (about 10 seconds) that checks your database access rules, your dependencies, and MCP server exposure.
• You can also run a Deep scan of your code from the Security view. It takes a few minutes and looks for things like exposed secrets and missing authorization.
• Your data lives in Lovable's built-in backend (Cloud) or your own Supabase project. Both use PostgreSQL with row-level security (RLS) rules that decide who can see which rows.
• Apps created from May 13, 2026 use TanStack Start, which renders pages on the server. Older apps are React + Vite, and anything in an environment variable starting with VITE_ is copied into the page your visitors download.

Lovable's scans look at your project from the inside. Throttle Bird looks at your published site from the outside, the way a stranger's browser sees it: what got shipped to the page, which headers your site sends, and whether your data answers a request with only the public key. Use both.

6 checks before you share the link

1. 1. Every table only shows people their own rows

   Why it matters: Misconfigured row-level security is the most common way Lovable apps leak data. A rule that says "true" lets every visitor read every row.

   How to check: Open More → Cloud → Database → RLS policies (or your Supabase dashboard). Then make two test accounts: create something as user A, log in as user B, and see if B can find it anywhere.

   Fix prompt to paste into Lovable

   Copy prompt

   Review the row-level security policies on every table. Make sure RLS is enabled on all of them, and that users can only read, add, change, or delete their own rows (for example auth.uid() = user_id). Remove any policy that uses USING (true) on private data. List each table and its policies when you're done.

2. 2. No secret keys in the page

   Why it matters: Anything in your frontend code can be copied by anyone who opens your site. A leaked OpenAI or Stripe secret key can run up a real bill.

   How to check: Only your Supabase URL and the public anon or publishable key belong in the browser. Ask Lovable where each paid service's key is used.

   Fix prompt to paste into Lovable

   Copy prompt

   Check whether any secret API key (OpenAI, Stripe secret key, Resend, Supabase service_role or secret key) is used in frontend code or in a VITE_ environment variable. Move every secret into a server-side function and store it as a secret, so only the public anon or publishable key is in the browser.

3. 3. Sign-up works for a stranger

   Why it matters: If the confirmation email lands in spam, or its link points to a preview or localhost address, new users get stuck at step one and never come back.

   How to check: In a private browser window on your phone, sign up with an email you've never used. Check that the email arrives and that its link opens your live site.

   Fix prompt to paste into Lovable

   Copy prompt

   Check my authentication settings. The site URL and every redirect URL should point to my live domain, not localhost or a preview URL. Make sure the sign-up confirmation and password reset emails link back to the live site.

4. 4. Leaked-password protection is on

   Why it matters: It stops people from signing up with passwords that already appeared in known data breaches.

   How to check: With Lovable's built-in backend, it's the Password HIBP check under More → Cloud → Users → Auth settings → Email. With your own Supabase project, it's under Supabase's password security settings.

   Fix prompt to paste into Lovable

   Copy prompt

   Turn on leaked password protection (the HIBP check) for sign-ups, and require a minimum password length of at least 8 characters.

5. 5. Server-side checks for anything that matters

   Why it matters: Your frontend runs on the visitor's computer, so they can change it. Prices, permissions, and limits have to be checked on the server.

   How to check: Ask yourself: if someone edited the page, could they get something for free or see someone else's account?

   Fix prompt to paste into Lovable

   Copy prompt

   Make sure every check that controls money, permissions, or usage limits runs in server-side code or database policies, not only in React components. List any place where the frontend alone decides what a user is allowed to do.

6. 6. Your link looks right when shared

   Why it matters: Your first users come from links in chats and posts. A blank preview with no title looks unfinished.

   How to check: Lovable has an SEO & AI search review under More in the project toolbar. Then text your link to yourself and look at the preview.

   Fix prompt to paste into Lovable

   Copy prompt

   Give every page a unique title and meta description, and add Open Graph tags with a 1200x630 share image so my link shows a proper preview in messages and social posts.

What the free scan checks on your live Lovable app

• Secret keys sitting in your page or its JavaScript files (Stripe, OpenAI, Anthropic, Supabase secret and service_role keys, GitHub, AWS, Google, private keys).
• If your page already exposes its Supabase or Firebase settings, one read-only test with the public key to see if a stranger can read your tables. Rows are never stored.
• Missing security headers that block injected scripts and click-jacking.
• HTTPS, certificate expiry, and whether plain http:// redirects to https://.
• Page title, description, link-preview tags, robots.txt and sitemap.
• How fast the page loads, page size, and JavaScript files that fail to load.

The scan only reads your public site. It never logs in, submits forms, or changes anything. It can't see inside your Lovable project, so it doesn't replace testing sign-up and payments yourself.

Scan my Lovable app free

Questions

Lovable already scans my app. Do I still need this?

Lovable's scan is a good start and you should run it. Throttle Bird checks the published site from the outside, the way a visitor's browser sees it, so it catches things like keys that ended up in the page and missing security headers. They work well together.

Is the Supabase anon key in my page a problem?

No. The anon (or publishable) key is meant to be public. What matters is that row-level security stops that key from reading private rows. Secret and service_role keys must never be in the page.

Does the scan change anything in my Lovable project?

No. It only reads your public site. It never logs in, submits forms, or writes to your database.