Is my Lovable app secure?
If you built your app with Lovable and connected Supabase, the honest answer is: it depends on settings you may never have looked at. Here is how to check the parts that matter most, without being a security engineer.
1. Check your Supabase tables
Open your Supabase project, go to the Table Editor, and look for tables marked as having RLS disabled. Any such table in the public schema can be read by anyone who has your anon key, and every visitor has it.
2. Look for secrets in the browser
Open your live site, open the browser developer tools, and search the loaded JavaScript for words like "sk-", "service_role" or "secret". Anything that is a private key should live in an edge function or server, never in frontend code.
3. Try a few public paths
Visit yoursite.com/.env and yoursite.com/.git/HEAD. You should get a 404 or your normal app page, never a file full of keys or git data.
4. Or let RowLocked check it
Our free scan does these checks for you, read-only. It looks at what a normal visitor's browser already loads, checks Supabase tables for anon readability using row counts only, and gives you a plain-English report with fix prompts you can paste back into Lovable.
Questions
Will the scan break or change my app?
No. It makes read-only requests, about 30 per scan, with no login attempts or exploit payloads. It never stores your database rows or full secrets.
Why check every week?
Every new prompt can add a table, a key or a route. A setting that was safe last week can change after one edit, which is why RowLocked is built around a weekly re-check.