AppLeakWatch
Security scanner for Lovable apps
Lovable makes it easy to get a working app live. It's also easy to ship one with database rules you've never looked at. AppLeakWatch checks your live Lovable app from the outside, the way a stranger would.
What usually goes wrong
Supabase tables anyone can read
Lovable apps often use Supabase, and the public key ships to every visitor by design. That's only safe when row-level security is on for every table.
Service keys in browser code
If a secret key reaches your front end, anyone can read it. A Supabase service role key bypasses all your database rules.
Public storage buckets
Files in a public bucket can be opened by anyone with the link, including private uploads.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.
More scanners
- Security scanner for Bolt apps
- Security scanner for apps built with Cursor
- Security scanner for Replit apps
- Security scanner for apps built with v0
- Security scanner for apps built with Windsurf
- Security scanner for Base44 apps
- Supabase RLS checker
- Firebase security rules checker
- Exposed API key scanner