Security audits for Lovable apps.
Every Lovable app runs on Supabase, and its public key ships in the page by design. Your data is exactly as safe as the row level security behind that key. We test whether yours holds, from the outside, and hand you the fix for everything that does not.
Why it matters
Lovable wires a Supabase backend into every app it builds, and Supabase is secure once configured, not by default. Each table needs row level security policies saying who may read and write it. When that step gets skipped, the public key that is meant to be shared returns the whole table to anyone who asks. We have seen what that exposes in practice: full bank account numbers in a lending product, patient access codes in a health app, stored authentication tokens in an education platform. The app works perfectly the whole time, which is why nobody notices. Of the 1,236 AI-built apps we have scanned, 21 came back clean.
What you get.
Row level security review
We go through every table in your Supabase project: is RLS enabled, and does the policy actually restrict anything? A policy of USING (true) shows as protected in the dashboard and lets anyone holding your public key read the table.
Public-key exposure test
We query your backend with the same anon key every visitor already has, unauthenticated, the exact surface an attacker sees, and show you which tables and fields hand back data they should not.
Two-account access test
We sign in as one user and try to read another user's records, the check that finds the flaws no scanner can confirm. An app checking that you are logged in is not the same as it checking that the data is yours.
Keys and secrets check
We search the deployed bundle, not just the source, for a service role or secret key. If one shipped, every policy you wrote is bypassed at once, and on legacy Supabase keys it cannot be rotated. We tell you exactly what to do about it.
Functions, storage and edge functions
Database functions callable with the public key, storage buckets without policies, and edge functions that verify no one. All reachable from outside, and all worth closing.
Prioritised report and free re-review
Every finding rated by severity with the concrete fix, and once you have applied the fixes we re-test the same surface at no extra cost.
How it works.
- 01
Access
You share the app's URL and a short walkthrough of what it does and who should see what. Much of the test needs nothing more than the public address.
- 02
Test
We probe the live app and its Supabase backend from outside, then review the policies with you, by hand, not just with an automated scan.
- 03
Report
You get a clear, prioritised write-up within days, plus a call to walk through it and the correct policy for each table.
- 04
Re-review
After you apply the fixes, we verify the exposed tables and endpoints are actually closed.
Common questions.
- The Supabase key is visible in my Lovable app. Is that the leak?
- No. The anon or publishable key is designed to be public; it identifies your project and gets a request as far as the anon role. Row level security policies are what protect your data, so the key is exactly as safe as your policies are. That is what we test.
- Doesn't Lovable handle security for me?
- Lovable sets up Supabase and authentication for the common paths, and it does that well. But the access rules for your specific data model, which user may read which table, are decisions only your app can make, and that is where nearly every serious finding lives. No builder can write those rules for you.
- What do you check?
- Row level security on every table and whether each policy actually restricts anything, live exposure tested with the public key, cross-account access with two real accounts, secret keys in the shipped bundle, and database functions, storage buckets and edge functions reachable without authorisation.
- Can you fix the issues, not just find them?
- Yes. We can write the policies and apply the fixes for you, or hand you a clear prioritised list. And if the app has outgrown the platform, we can migrate it onto infrastructure you own outright.
- How much does a Lovable security audit cost?
- It is scoped to a fixed quote up front, with no hourly meter, and typically starts around $750 depending on the size of the app. You will know the price before we begin.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.