For Lovable builders
Security audit for Lovable apps before you launch
Lovable generates a React front end wired directly to Supabase. That is a great way to ship in a day, and it also means most of your security lives in database policies you may never have looked at: if a table has no row-level security, every signed-in user can read every row through the public anon key.
VibeAudit reads the GitHub repo Lovable syncs to, finds the routes, policies and keys, and tells you what will break or leak once strangers sign up.
Scan your Lovable app now — free, under a minute, no signup
Paste the GitHub repository URL. Public repos work as-is; sign in with GitHub for private ones.
What Lovable apps usually ship with
From our audits of real repositories. Every item below is something the deep audit reports with file and line, plus a fix prompt.
Lovable's generated SQL often creates tables first and policies later, or with `using (true)`. The anon key is public, so the policy is the only lock.
An `isAdmin` flag in React state hides buttons; it does not stop a user from calling the same Supabase query themselves.
Generated edge functions that call OpenAI or send email are often callable by anyone with the URL, which means anyone can spend your credits.
A service-role key or third-party API key that ended up in a `VITE_` variable is visible to every visitor.
Read before you launch
- Permissive RLS, Firestore rules and public storage buckets · coming soon
- API routes and server actions with no auth check · coming soon
- Missing ownership checks (IDOR): reading and editing other users' data · coming soon
- Supabase service-role and secret keys leaking to the browser · coming soon
- Stripe webhooks, idempotency and billing logic bugs →
FAQ
- Do I need to export anything from Lovable?
- No. Connect the GitHub sync in Lovable (Settings → GitHub), then paste the repo URL here. Private repos work after signing in with GitHub.
- Does it check my Supabase project directly?
- It reads the SQL, policies and edge functions in your repo. It does not connect to your live database.