What usually goes wrong in Lovable apps
An independent researcher who scanned 62 Lovable apps found critical or high-severity issues in 63% of them, and 77% of those apps ran on Supabase. The patterns repeat:
- Tables created during a prompt with row-level security left off
- Policies widened to using (true) to make a screen work
- A Supabase service key pasted into the frontend to get past an error
- Storage buckets set to public with listing allowed
What about Lovable's own security check?
Lovable runs a security check on every publish and offers an AI review. Use it. It catches issues while you build, in Lovable's own terms. LeakScan is an independent check from the outside: it reads your database catalog with a role you control, tests what the public key can read, checks your commit history and headers, and gives you a report you can share with a client or developer.
Fix prompts written for Lovable
Every finding comes with a prompt you paste into Lovable's chat. It names the tables, the policies and the screens to change, so Lovable makes the fix while you watch. One free rescan within 14 days confirms it worked.
Common questions
Do I need to export my Lovable project?
No. Connect the GitHub repository Lovable syncs to, run one SQL snippet in your Supabase project, and verify your domain. The database checks need a Supabase project you own; a project managed by Lovable Cloud gives you no SQL editor to run the snippet in.
Does it work on a lovable.app address?
Yes, as long as you can prove you control the app. Custom domains work the same way.