Lovable
Supabase RLS on a Lovable app
Lovable turns a chat into a hosted app. The preview URL and the production URL both serve HTML and JavaScript to anyone who opens them. Variables that the framework marks as public, and secrets pasted into a client component, travel with that bundle.
How a public bundle relates to Row Level Security, which this scan does not read.
What the scan can see
If a service_role JWT is in the page or a same-origin script, the scan flags it. That key bypasses Row Level Security, so it must not ship to the browser. An anon JWT is recorded as informational, because the client is supposed to have it.
What it does not do
This scan does not connect to Postgres, list tables, or read RLS policies. A quiet result does not mean RLS is on. The ownership-verified RLS check is listed on the report as coming soon and is not run.
A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
What to do next
Rotate a leaked service_role key. Review policies in the Supabase SQL editor yourself. Private tables should deny access unless the signed-in user is the one you expect. This product will not run those queries for you.
Questions
Does this open my Lovable project?
No. A scan of a Lovable URL does not open the Lovable project, the chat history, or env vars that stayed on the server. If the browser never downloaded it, this check will not see it.
Can the scan prove supabase rls is fully fixed?
This scan does not connect to Postgres, list tables, or read RLS policies. A quiet result does not mean RLS is on. The ownership-verified RLS check is listed on the report as coming soon and is not run.
What should I do if the scan finds it?
Rotate a leaked service_role key. Review policies in the Supabase SQL editor yourself. Private tables should deny access unless the signed-in user is the one you expect. This product will not run those queries for you.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.