Guides

Security guides

These pages describe the checks LeakWatch runs on a public URL. They are not a certification, and LeakWatch is not affiliated with Lovable, Bolt, Cursor, or Supabase.

• Is a Supabase anon key safe?

  The anon key is public. The tables it can read are the problem.

• How to check Supabase RLS

  A read-only request with the anon key shows whether a table is open.

• Lovable app security checklist

  Secrets in the bundle, open tables, and public .env files.

• What a public scan can see

  The checks behind every LeakWatch report.

• Is my .env file public?

  GET /.env counts only when the body looks like environment variables.

Lovable security scanner · Scan any URL you have permission to test