Is my Lovable app secure? 8-point checklist + free scan

Eight things to check on a live Lovable app, each with a fix prompt you can paste straight into Lovable. Or run the free scan and get all eight checked in seconds.

1. No secret API keys in your HTML or JS bundles

   We scan your page and up to 15 same-origin JS bundles for live Stripe, OpenAI, Anthropic, AWS, GitHub, Google, Slack keys and private key blocks.

   Fix prompt (copy into Lovable):

   A secret API key is exposed in my frontend code. Move every call that uses it into a Supabase Edge Function with the key stored in Supabase secrets, remove it from client code and any VITE_ variables, and tell me which keys I must rotate.

2. No Supabase service_role key in the browser

   A service_role key bypasses Row Level Security. We decode Supabase JWTs in your bundles and flag any with role service_role.

   Fix prompt (copy into Lovable):

   My Lovable app ships a Supabase service_role key to the browser. Replace it with the anon key in client code, move privileged queries into a Supabase Edge Function with the key stored in Supabase secrets, make sure RLS is enabled on every table, and remind me to rotate the service_role key.

3. /.env is not publicly readable

   We request /.env on your domain and flag it if it returns environment variables.

   Fix prompt (copy into Lovable):

   My deployed Lovable site serves /.env publicly. Make sure .env files are never copied into the build output or public folder, add them to .gitignore, and tell me to rotate every value that was in it.

4. /.git is not publicly readable

   We request /.git/HEAD and /.git/config, which expose your source history if served.

   Fix prompt (copy into Lovable):

   My deployed Lovable site serves the /.git folder. Exclude .git from the published output and confirm /.git/HEAD returns 404 after redeploying.

5. No production source maps

   We probe the .map files for your JS bundles. Public source maps hand out your original source code.

   Fix prompt (copy into Lovable):

   My Lovable production build publishes JavaScript source maps. Disable them for production (vite.config: build.sourcemap = false) and redeploy.

6. HTTPS with a valid, non-expiring certificate

   We flag plain-HTTP sites and certificates that are expired or expire within 14 days.

   Fix prompt (copy into Lovable):

   Make sure my Lovable app is only served over HTTPS: redirect HTTP to HTTPS and check the custom domain settings so the SSL certificate auto-renews.

7. Security headers: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy

   We read your response headers and flag each missing one.

   Fix prompt (copy into Lovable):

   Add these HTTP security headers to my published Lovable app: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff and Referrer-Policy. Keep the CSP compatible with my Supabase and analytics domains.

8. Homepage loads: no error page, blank build or slow response

   We check the HTTP status, response time (warn over 5 s), near-empty pages and visible error messages.

   Fix prompt (copy into Lovable):

   My Lovable app's homepage is broken (error page, blank page or very slow). Look at the latest change you made, check the console and build errors, and fix or roll back that change.

Other checklists: Bolt · Base44 · Replit · v0