Does Lovable scan the live site for you?

LeakWatch does not speak for Lovable. This checklist is an outside read of the deployed URL. It does not open the Lovable project or review the builder's private files.

What are the three checks that matter first?

The Supabase anon key must not be able to read private tables. The service_role key and other live secrets must not be in the JavaScript. /.env and /.env.local must not answer with real environment assignments.

Is a clean checklist a security certification?

No. These are the passive checks LeakWatch runs. A quiet result means those checks found nothing. It is not a penetration test and not a certification.

Guide

Lovable app security checklist

A deployed Lovable app is an ordinary website. Before you share it, confirm the anon key cannot read private tables, no privileged secret is in the JavaScript, and /.env is not public.

The deployed URL loads without asking the visitor for a secret that should have stayed on the server.
The Supabase anon key, if present, cannot read private tables. A returned row means row level security is missing or public.
The service_role key and any sb_secret key are not in the HTML or JavaScript. If either is, remove it and rotate it. Both bypass row level security.
Live Stripe secrets, OpenAI keys, cloud tokens, and private keys are not in the bundle. Publishable keys and placeholders are not leaks.
/.env and /.env.local do not return environment assignments. An HTML page at that path is not counted as the file.
/.git/config and script source maps are not public.
Firebase, if the page includes a client config, does not answer an unauthenticated read. Document bodies are not stored.
Missing security headers are noted as low. They are hygiene, not proof that data was exposed.

LeakWatch runs those checks with GET requests against the public URL. It does not sign in to Lovable, and it is not affiliated with Lovable. A fix prompt on a paid report is text you can paste back into the builder. It is not an integration.

The free scan requires an email and one scan per network every 30 days. The free report names every finding and shows the most serious one in full. The $19 Proof Report opens the location, evidence, and fix prompt for the rest. Pro ($29/month) also opens reports. Monitoring ($9/month) does not. Open the Lovable security scanner or scan from the homepage.

Questions

Does Lovable scan the live site for you?: LeakWatch does not speak for Lovable. This checklist is an outside read of the deployed URL. It does not open the Lovable project or review the builder's private files.
What are the three checks that matter first?: The Supabase anon key must not be able to read private tables. The service_role key and other live secrets must not be in the JavaScript. /.env and /.env.local must not answer with real environment assignments.
Is a clean checklist a security certification?: No. These are the passive checks LeakWatch runs. A quiet result means those checks found nothing. It is not a penetration test and not a certification.