Built with Lovable

Is your Lovable app safe?

Lovable built it and Supabase holds its data. Enter the address and we ask your app what a stranger would ask it. No account needed.

What the free check asks your app

A Lovable app keeps its data and its sign-ins in Lovable Cloud, which is built on Supabase, or in a Supabase project you connect. Every table is only as safe as the row-level security rule written for it.

Can your database tables be read without signing in?
What could happen Anyone can download those tables in full.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 0 of 8 safe ones broken.
Free check, with your OKCritical at worstHow we check
Can strangers sign up as someone else, or without an account?
What could happen Someone opens an account in a customer's name, or passes a rule meant for real customers.
On 20 cases it had never seen, it found 10 of 10 broken setups and called 0 of 10 safe ones broken.
Free check, with your OKMedium at worstHow we check
Does your file storage show strangers what it holds?
What could happen Every file in a public bucket can be downloaded by anyone who has or guesses its link.
On 20 cases it had never seen, it found 10 of 10 broken setups and called 0 of 10 safe ones broken.
Free check, with your OKLow at worstHow we check
Are secret keys or passwords in what browsers download?
What could happen Anyone can read the key in their browser's tools and use it, so treat it as already known and replace it.
On 16 cases it had never seen, it found 8 of 8 broken setups and called 1 of 8 safe ones broken.
Free checkHow we check

On a Lovable address

Your app lives on Lovable’s domain until you give it one of your own. That changes three things.

The first check runs every question above, on the tick you give it, and shows each finding’s title and how serious it is at once.
For the checks that need your OK, where a finding sits and how to fix it open once you confirm your domain. That takes one DNS record, so it needs a domain of your own instead of your-app.lovable.app.
On your-app.lovable.app we skip the checks of your email records and of subdomains others could claim, because those belong to Lovable.

Put your app on your own domain in Lovable

What we read once your repository is connected

Some mistakes only show in the code. On a paid plan we read your repository too.

Do your database rules let anyone change other people’s data?
What could happen Anyone with the public key changes or deletes rows that belong to other people.
On 20 cases it had never seen, it found 9 of 10 broken setups and called 0 of 10 safe ones broken.
Paid plan, your repositoryHigh at worstHow we check
Can users make themselves admins or give themselves a paid plan?
What could happen Any user becomes an admin, reads another user's data, or changes and deletes users in your database.
Paid plan, your codeCritical at worstHow we check
Can anyone tell your app a payment went through?
What could happen People get paid features for free or for less, or real payments fail to count.
Paid plan, your codeCritical at worstHow we check

Lovable’s check and ours

Lovable’s own security scan reviews your database rules and your dependencies inside the editor. We ask the app you published, from the outside, the way a stranger would.

Lovable

While you build

Reads your project in the editor, before it goes out.

Vallit

Once it is live

Asks the published app from the outside, then again every day.

Both are worth having. Theirs reads your project while you build. Ours checks the live app again every day, and our team can fix what it finds.

What Lovable checks

How often these checks are right

Read the study

We wrote 92 cases these checks had never seen, half broken and half safe, and scored each set once.

of the 7 checks on this page were in the benchmark: 5
broken setups they found the first time: 45 of 46
safe setups they called broken: 1 of 46