New: CheckVibe MCP server — scan from Claude Code and Cursor nativelyRead the docs
Lovable builds it pretty. Did it build it locked?
Lovable.dev produces gorgeous, polished React apps faster than almost anything. But the same speed that ships your MVP in a weekend also ships any security gap straight to production. We've scanned hundreds of Lovable apps. The pattern is consistent.
Get a graded security report for your Lovable.dev app in under a minute.
Any Lovable app using `supabase.from('users').select('*')` from the client side is reading data through the `anon` key. Without RLS, that reads the whole table. CheckVibe enumerates and verifies.
OpenAI, Anthropic, Stripe, Resend keys frequently end up in client bundles. We scan static JS for 30+ key shapes.
No CSP, no HSTS, no Permissions-Policy. Each one is a layered defense Lovable doesn't set by default.
Common patterns like `?redirect=` or `?next=` get used without origin validation — phishing risk.
Lovable's generated `package.json` pins to specific versions and rarely refreshes. CheckVibe cross-references the SBOM with active CVEs.
No rate limit on signup → no defense against credential stuffing. No password complexity enforcement.
Run `SELECT tablename FROM pg_tables WHERE schemaname = 'public'` and verify each has RLS on with appropriate policies.
OpenAI, Stripe, etc. should be called from Lovable's edge functions or API routes — never directly from the browser.
Even a starter CSP blocks 80% of XSS. CheckVibe generates a tailored one based on what your app actually loads.
Use `npm audit` or schedule a CheckVibe scan to surface CVEs in your SBOM automatically.
Supabase Auth supports both; Lovable just doesn't turn them on. Two minutes in the dashboard.
It generates clean code, but the security layer is your responsibility. Default scaffolds skip RLS, headers, and rate limits — all of which CheckVibe flags.
If you haven't enabled Row Level Security on a table that the client queries, yes — anyone with your public anon key (which is in your JS bundle by design) can read the whole table.
Open DevTools, view source, search the bundle for `sk_`, `pk_`, or `AIza`. Or paste your URL into CheckVibe — we do this and 100 other checks in 30 seconds.
Yes — Lovable apps deploy to public URLs, which is all CheckVibe needs. We also detect Supabase as the backend and run native Supabase scanners.
