Security
Is your AI-built app secure? We check keys, RLS and data protection
The platform builds the app quickly. Who can access each table and where each key lives are still your decisions. That is where data leaks.
Our team checks who can read each table in your database, where the keys live and what data protection law requires of your app.
In the browser
On the server
account B reads orders
Order 1042 from account A shows up for account B
RLS on: account B only sees its own orders
1The problem
Signs the app is already heavy
- You cannot say who is able to read each table in the database.
- There is a payment, email or AI key in the code that runs in the browser.
- The app stores names, emails or ID numbers and still has no privacy policy.
2What we do
What the service includes
Secrets
We look for keys on the live site and in the repository and tell you which ones must leave the browser.
Data access
We read the RLS table by table and test with two accounts whether one can see the other’s data.
Routes and functions
We check which pages and functions require login and whether each function verifies who is calling.
Data protection and domain email
Terms, privacy and cookies against what the app collects. SPF, DKIM and DMARC on the domain.
3Where it starts
The diagnostic shows what to do in your app.
US$ 79
Diagnostic
Report in 2 business days and a live meeting. Credited if you hire the service within 15 days.
The service is quoted after the diagnostic, with a fixed scope. The timeline comes with the quote, after the diagnostic.
Not included: penetration testing, business-rule review and legal opinions. The diagnostic does not open your users’ data.
About the diagnostic →Frequently asked questions
Frequently asked questions
Lovable already has a security scanner. Do I need another review?
The scanner helps and should be run. Lovable’s own documentation says its tools do not replace a full review. The diagnostic covers what the scanner cannot: whether the access rules make sense for your business, whether functions verify who is calling and what data protection law requires.
The Supabase key shows up on the site. Is that a leak?
It depends on the key. The publishable key (sb_publishable_ or the older anon) is meant to be in the browser, as long as every table has RLS. The secret key (sb_secret_ or the older service_role) bypasses RLS and must never be on the site.
After the fixes, will the app be 100% secure?
No. The checkup and the fixes reduce the risk to your app. No service eliminates it. The report shows the state of the app on the review dates.
Guides on this topic
Is Lovable secure? 7 checks before you use real data
Lovable checks part of your app's security, but the responsibility is yours. Here are 7 checks to run before you open the app to customers.
Supabase RLS: how to configure and test it in your app
Step by step: turn on RLS in Supabase, write one policy per operation and use the public key to test whether your app's tables are protected.
Start with the diagnostic.
The diagnostic costs US$ 79, paid by payment link. We deliver the report in 2 business days and walk you through the findings in a meeting. The fee is credited if you hire the service within 15 days. Everything we set up stays in your name.
Reduces the risk, does not eliminate it. We only work with the app’s owner, with proof of ownership.