Lovable
Firebase security rules on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
What a public Firebase config means, and why rules are a separate check.
What the scan can see
A Firebase web config in the client is a note. The apiKey in that config is meant to be public. A Google API key string and any other secret in the same files are reported with their own severity.
What it does not do
Firestore, Realtime Database, and Storage rules are not downloaded, and the scan does not try an anonymous read. Rules stay in the locked section of the report until domain ownership exists.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Open the Firebase console and read the rules for each database and bucket. Hiding the web apiKey does not protect data. Rules do.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove firebase security rules is fully fixed?
Firestore, Realtime Database, and Storage rules are not downloaded, and the scan does not try an anonymous read. Rules stay in the locked section of the report until domain ownership exists.
What should I do if the scan finds it?
Open the Firebase console and read the rules for each database and bucket. Hiding the web apiKey does not protect data. Rules do.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.