Skip to content

The problem list is free. A fix prompt for each one is $9.

See pricing
Vibe App Watchdog

Lovable

The Lovable preview is already public

Lovable ships a URL from the chat. Anything in the HTML or the JavaScript that URL serves is visible to whoever opens it, including this scan.

  • Secrets in the client bundle

    A key pasted into a component, or stored in a variable the framework marks public, is downloaded with the page. The scan looks for Stripe, OpenAI, Anthropic, AWS, GitHub, Slack, and Supabase service_role shapes in that public code.

  • A public .env

    We request /.env, /.env.local, and /.env.production once each. Assignment lines are a finding. An HTML app shell at those paths is not.

  • Headers the preview never set

    Content-Security-Policy, framing protection, nosniff, and Referrer-Policy are read from the response. Missing ones show up even when the chat looks fine.

The scan does not open the Lovable project or the chat. It only fetches the URL you paste.

Scan a URL you own

The same free check as the homepage. You confirm the app is yours before it runs.

Free public scan

After the results

Monitor weekly: $9/mo

The free scan lists what is already public. Watchdog Monitor re-checks that app every week and emails the grade, plus what is new or fixed. Fix prompts stay a separate $9 one-time unlock on the report.

Monitor weekly: $9/mo

Run the free scan first. The monitor button is on the report.

Is Lovable secure? →