Lovable App Security Checklist

1. Check which Supabase key is in your app

Your Lovable app talks to Supabase using a key that lives in the browser. There are two kinds:

How to check: Open your live app → DevTools → Sources → search for service_role. Or paste your URL into ChillScan. We flag Supabase service_role keys specifically.

If you find it: Rotate it in your Supabase dashboard (Project Settings → API), then move whatever needed it into an edge function.

Audit this project for any use of the Supabase service_role key in client-side code. Move any privileged operations into a Supabase Edge Function that reads the key from secrets, and make sure the frontend only uses the anon key.

2. Turn on Row Level Security for every table

The anon key is only safe because RLS decides who can see what. If a table has RLS off, anyone with your (public) anon key can read it.

How to check: Supabase dashboard → Table Editor. Every table should show RLS enabled. Then check the policies make sense: "users can read their own rows", not "anyone can read everything".

Quick test: Log in as user A, copy a request for your own data, change the user/row ID, and see if you get user B's data. If you do, your policies need work.

Enable Row Level Security on every table and add policies so users can only read and modify their own rows (based on auth.uid()). List each table and the policy you added.

3. Keep AI and payment keys in edge function secrets

OpenAI, Anthropic, Stripe secret keys and the like should never be in your React code. Put them in Supabase Edge Function secrets and call them from an edge function.

How to check: Search your live JS for sk-, sk-ant-, sk_live_.

Bonus: Add basic rate limiting to any edge function that calls a paid API, so one curious visitor can't run up your bill.

4. Add security headers on your domain

Lovable-hosted and custom-domain setups often ship without security headers. At minimum you want: Strict-Transport-Security, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and a Content-Security-Policy (start in report-only mode).

Where you set them depends on hosting (Lovable hosting, Netlify, Vercel, Cloudflare in front, etc.). See also what ChillScan checks for headers.

5. HTTPS, all the way

Make sure http:// redirects to https:// in one hop on your custom domain, and that no images or scripts load over plain HTTP.

6. Make it findable (SEO basics)

Lovable apps are single-page React apps, so:

• Set a real <title> and meta description, not the default.
• Add Open Graph tags + an OG image so your link looks good when shared.
• Add robots.txt and a sitemap.xml that lists your public pages.
• Check View Source: if your landing page text isn't in there, crawlers may see a blank page. Consider a pre-rendered/static landing page.

Add a proper title, meta description, Open Graph and Twitter card tags for each public route, generate a sitemap.xml and robots.txt, and make sure the landing page content is present in the initial HTML.

7. Speed check

Big JS bundles slow down first load, especially on phones. Lazy-load heavy pages and compress images. ChillScan reports your server response time, page weight and bundle size.

The Lovable pre-launch checklist

Copy this into a note before you share the link.

[ ] No service_role key in frontend (rotated if it ever was)
[ ] RLS enabled on every table, sensible policies
[ ] Tested: user A can't read user B's data
[ ] AI/Stripe secrets in edge function secrets, not React code
[ ] Rate limits on paid-API edge functions
[ ] Security headers set on your domain
[ ] HTTP → HTTPS, no mixed content
[ ] Title, description, OG tags, sitemap, robots
[ ] Landing page content in View Source
[ ] Mobile load feels fast