Lovable
Missing security headers on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
Headers the document response already sends, or does not send.
What the scan can see
Content-Security-Policy, Strict-Transport-Security on HTTPS, X-Content-Type-Options, framing protection via X-Frame-Options or CSP frame-ancestors, and Referrer-Policy. A missing Permissions-Policy is informational and does not drop the letter by itself. Either framing control is enough.
What it does not do
The scan does not score how strict a CSP is beyond whether it exists and whether frame-ancestors is set. A header that exists only on an API route we never request is not graded.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Add the missing headers on the host, redeploy, and scan again. Turn HSTS on only after HTTP already redirects to HTTPS.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove missing security headers is fully fixed?
The scan does not score how strict a CSP is beyond whether it exists and whether frame-ancestors is set. A header that exists only on an API route we never request is not graded.
What should I do if the scan finds it?
Add the missing headers on the host, redeploy, and scan again. Turn HSTS on only after HTTP already redirects to HTTPS.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.