Lovable
Missing robots.txt on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
A launch file, not a security boundary.
What the scan can see
The scan requests /robots.txt and /sitemap.xml. A 404, or an HTML app shell, counts as missing. A noindex meta tag or X-Robots-Tag on the homepage is a separate finding, because a public launch usually wants to be indexed.
What it does not do
robots.txt does not hide a URL that is already linked. It is not an access control.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Serve a plain-text robots.txt and an XML sitemap. Remove noindex from the homepage if the app should be found. Keep noindex on private pages such as this scan report.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove missing robots.txt is fully fixed?
robots.txt does not hide a URL that is already linked. It is not an access control.
What should I do if the scan finds it?
Serve a plain-text robots.txt and an XML sitemap. Remove noindex from the homepage if the app should be found. Keep noindex on private pages such as this scan report.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.