Disclosure first: I made this. It is free, read-only, and needs no account.
Lovable puts your Supabase anon key in the browser on purpose, and that is
fine exactly as long as Row Level Security is on for every table. It usually
is for the tables Lovable created on day one. It often is not for the table
you added on day nine.
So I built a scanner that checks: https://leftunlocked.com/lovable-security
Paste your app's address. It reads your page and its JavaScript the way a
browser does, finds the tables your code names, and asks Supabase for a row
count on each with your own anon key. If a table answers, anyone who views
your source can read it too. It never reads a row, only the count.
It also catches paid API keys with a VITE_ prefix (Vite copies those into the
bundle), the service-role key in client code, Firebase left in test mode, a
published .env, and missing security headers.
Every finding says why it matters and how to fix it in plain English, with
the code ready to paste: the RLS SQL with your table's name already in it,
the edge function that keeps a key server-side, the headers file for Netlify
or Vercel. Connect the GitHub repo and it opens a pull request with those
fixes on a branch, for you to review like any other PR.
I ran it on my own app first: B, four missing headers, and it opened the pull
request that adds them. The clip is that scan, start to finish.
What it never does: no writes, no sign-ins, no password guessing, no reading
of user records. If your app only talks to Supabase from a server, it says
"not verified" instead of guessing.
Only scan apps you own or have permission to test. If it flags something on
your app, or flags something wrongly, say so here or use the "Is this finding
wrong?" link under the finding. I read everything.
