Is My Lovable App Secure? A Plain-English Safety Check

I asked myself this exact question about my own app, decided the answer was yes, and was wrong.

I had been an engineer for ten years at that point. I built a small tool almost entirely with AI, clicked around it, everything worked, and I put it on LinkedIn asking developers to try it. The first person who did told me, within the hour, that connecting his account meant handing my app the keys to every private repository he owned. I had never asked for that. It just came out that way, and I shipped it without looking.

So I am not going to tell you your app is probably fine, and I am not going to tell you it is probably a disaster. I am going to tell you what to look at, because looking is the only thing that settles it, and clicking around your own app is not looking.

One thing worth saying plainly first. Lovable is not the problem here, and neither is Bolt or Replit or Claude Code. These tools build what you describe. What they do not do is stop and say by the way, you never told me who is allowed to read this. That sentence is the entire subject of this page.

The five that matter

There are dozens of things one could check. These five are the ones that actually cause the stories you have read, roughly in order of how often I find them.

1. Can anyone read your database?

Most Lovable apps store their data in Supabase, and a table created without rules is readable by anyone holding your public key, which is sitting in your page source because it is designed to. Open your Supabase Table Editor and look for a badge saying Unrestricted. That word means what it sounds like.

This is the single most common serious problem I find, and the full walkthrough is here if you find one.

2. Is there a secret in your public code?

Open your live site, view source, and search the page for anything that looks like a key. Some keys are meant to be there. Others are not, and one Supabase key in particular ignores every rule you set, which makes all your other work irrelevant if it leaked.

This is the one that caught me, in a different shape. Worth ninety seconds even if you are confident.

3. Does your login actually check anything?

There is a difference between hiding a page and protecting it. If your app decides what to show by hiding buttons, everything behind those buttons is still there for anyone who asks for it directly.

The test takes a minute: open a private window, do not sign in, and go straight to your dashboard or admin address. A protected app sends you to a login screen. If your data loads, the lock was painted on.

4. Can someone read another person's record?

This one is subtle and I find it constantly. Agents write endpoints that take an id from the request and return that record. It works perfectly when your app asks for the right id. It also works perfectly when a stranger changes the number to somebody else's.

If your app has addresses with an id in them, sign in as yourself and change the id to another one. If you can see data that is not yours, that is the problem, and it is usually a one-line fix once you know.

5. Is anything stopping abuse?

Without limits, someone can hammer your signup form ten thousand times, guess passwords all night, or run up a bill on any endpoint that calls a paid service. Less urgent than an open database, and the way a quiet month turns into a surprise invoice.

What none of this tells you

I would rather be honest about the limits of a checklist than sell you certainty.

Everything above is what you can see from outside, logged out, in a few minutes. It is genuinely worth doing and it catches most of what goes wrong. What it does not cover is the half of your app that lives behind the login, which is usually where the interesting data is, and it cannot tell you whether a rule that exists is actually the rule you meant. Those need someone to sit with it.

If you would rather someone looked

Send me your app's address. I will go through it myself before we speak, then we take half an hour and I will tell you what I found in normal words, including the things this page cannot check. It is free and there is no pitch at the end of it.

And if it turns out your app is in good shape, I will tell you that and you will have lost half an hour. That happens, and it is a perfectly good outcome. It is more than I could say for myself the day Dan wrote to me.