Add-on · $49
Security Lockdown
We scan your app for leaked keys, committed .env files, Supabase service role keys in client code, and tables with row level security off or overly permissive policies. Then we fix what we find and scan again.
$49 on Go Live Fix or Launch. Included with Launch + Care. Other scanners hand you a list. We change the repo and scan again to confirm.
What we check
Leaked keys
API keys, tokens, and private keys committed in source. The report names the file and the kind of key. It does not print the secret.
Committed .env files
.env, .env.local, .env.production, and the same family of files when they are in the repository. A file that only lives on your laptop is outside this check.
Supabase service role keys in client code
The service role bypasses row level security. It belongs on a server you control. A Vite bundle or a Next.js client component is the wrong place for it.
Row level security off, or a policy that is too open
SQL in the repo that creates a table and never enables row level security, and policies that use USING (true) or WITH CHECK (true) so every role that can reach the table can read or write every row.
What we fix
- Take the leaked secret out of the files that ship, and point the app at a host environment variable instead.
- Stop tracking .env files and add the ignore rule so the next commit does not put them back. If a secret was already pushed, we name the key you need to rotate. Rotation happens at the provider. A deleted line does not recall a key someone already copied.
- Remove a service role key from the browser. The replacement is the anon key plus row level security, or a server route that holds the service role.
- Turn row level security on, and replace a wide-open policy with one that matches the rows the app is supposed to read and write.
- Run the same checks again and send you the second result.
What this does not cover
- A penetration test, and vulnerability classes outside this list, including cross-site scripting, dependency advisories, and business-logic bugs.
- Settings that exist only in the Supabase dashboard, the host, or DNS, unless you give us access and they are part of the work.
- A rewrite of git history. We remove the secret from the current app. A key that was already public still has to be rotated.
- Code you add after the scan date.
- A verdict on whether a Lovable app is affected by CVE-2025-48757. That record covers Lovable through 2025-04-15, and the supplier disputes it. We check the repository you send.
Why this exists
CVE-2025-48757 records an insufficient database row-level security policy in Lovable through 2025-04-15. The official record says that allowed a remote unauthenticated attacker to read or write arbitrary database tables of generated sites. The supplier disputes the report. The CVE note says each Lovable customer accepts responsibility for protecting their application's data. The record does not say that every current Lovable app is exposed, and we don't either.
Disclaimer
The check covers the specific issues on this page as of the scan date. It is not a guarantee against future breaches.