Scanner
Lovable security scanner
Paste the public URL of a Lovable app. LeakWatch reads that live site for leaked keys, tables the anon key can read, open Firebase rules, and exposed .env files. It does not open your Lovable project.
What this scan checks
Leaked keys
Live secrets in the HTML and JavaScript. A Supabase service_role JWT is critical. The anon key alone is info.
Supabase tables
One read-only GET with limit=1. A row means row level security is missing or public. Real values are not stored. A masked example can appear on a Proof Report.
Firebase rules
One shallow Realtime Database read and one Firestore list when a client config is present. Real document values are not stored.
Public files
/.env, /.env.local, /.git/config, /config.json, and source maps. An HTML page at /.env is not treated as the file.
The same checks run from the homepage. Read the Lovable checklist for the list without the form. A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month.
Questions
- Does this connect to my Lovable account?
- No. You paste the deployed URL. LeakWatch fetches that public page. It does not sign in to Lovable and it is not affiliated with Lovable.
- What does the free scan show?
- The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan is allowed per network every 30 days.
- Is an anon key in a Lovable app a critical leak?
- No. The anon key and the sb_publishable key are public configuration. LeakWatch marks either as info unless that key can read a table. A returned row with personal or payment columns is critical. Any other returned row is high. A service_role JWT or an sb_secret key in the page is critical on its own and is not used to query.