Free tool · no signup
Lovable security checker
Check whether your Lovable app is leaking secret keys, .env files or source maps before you take real users. Seven public checks with copy-paste fixes.
Only public pages are read. Results are not stored and keys are always redacted.
Still do this yourself before you take payments
- Row Level Security. A policy of
USING (true)still lets any signed-in user read every row. Create two accounts and confirm one cannot see the other's data. - Stripe webhooks. Verify the signature; an unsigned endpoint lets anyone mark themselves as paid.
- Admin pages. Sign out and open your admin address in a private window. Hidden in the menu is not the same as locked on the server.
What the checker tests
Secret keys in the frontend
Stripe sk_live / sk_test, OpenAI, AWS, GitHub, Resend and SendGrid keys and private keys in your public JavaScript. Matches are always redacted.
Supabase keys
The anon / publishable key is expected in the browser. A service_role or sb_secret_ key bypasses Row Level Security and is an emergency.
.env and .git files
Flagged only when the response is a real file, not your app's normal page served for every address.
Source maps
Published .map files that let anyone read your original source code.
HTTPS
The site loads over HTTPS and http:// redirects to https://.
Security headers
Strict-Transport-Security, X-Content-Type-Options and clickjacking protection.
Mixed content
Scripts, styles, images or frames still loaded over insecure http://.
Frequently asked questions
- Is the Supabase anon key a security leak?
- No. The anon or publishable key is designed to ship in the browser; Row Level Security on each table is your real protection. A service_role or sb_secret_ key in the frontend is an emergency — rotate it immediately.
- Does this checker test Row Level Security?
- No. Access rules live in your database, not in public pages. Test with two accounts and confirm one cannot see the other's data. SaaS Sentinel reads Supabase's own security advisories for the projects you monitor.
- What should I do if a secret key is found?
- Rotate the key with the provider first so the leaked copy stops working, then move it into server-side code and an environment secret. Each failing check includes a copy-paste prompt for Lovable.
- Is this security checker free, and is my result stored?
- Yes, it's free with no signup, and works with any public lovable.app or custom domain. Results are not stored. To run the same checks every day and get alerted, add the app to SaaS Sentinel.
Monitoring a portfolio of apps? See how SaaS Sentinel covers security and compliance.
More free tools
Link preview checker
How your link looks when shared on Google, X, LinkedIn, Facebook and Slack.
CORS checker
Whether other websites can read your app's responses or use your visitors' logins.
DNSSEC checker
Whether your domain's DNS is signed, so visitors can't be sent to a forged server.
404 page checker
Whether missing pages return a real, branded 404 that helps visitors back.