Lovable
Exposed API keys on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
Keys that the browser can already download.
What the scan can see
The scan looks for high-confidence shapes in the HTML, up to 10 same-origin scripts, and a public env file: Stripe secret and webhook keys, OpenAI, Anthropic, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys. A Stripe publishable key and a Supabase anon key are notes, not leaks. The stored report keeps a short prefix and suffix, not the full secret.
What it does not do
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove exposed api keys is fully fixed?
Keys on other hosts, keys assembled at runtime, and keys that never shipped are missed. The scan does not call the provider to see if a key still works.
What should I do if the scan finds it?
Roll a live secret in that provider's dashboard first. Then remove it from client code and from any public env prefix. The $9 report is a paste-ready prompt for Lovable, Cursor, and Bolt that names the file path we saw.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.