Lovable
Check a Lovable app that is already on the internet
Lovable ships a URL. That URL is what a visitor, and this scan, can see. Paste a published app you own or are allowed to test. We fetch the public page and tell you what is already in it.
The problem list is free after you leave an email. Nine dollars unlocks a fix prompt for each problem, written so you can paste it back into Lovable.
What this scan actually checks
- The HTML of the URL you paste, including inline scripts.
- Up to 10 JavaScript files linked from that page, and only if they are on the same host.
- Response headers: Content-Security-Policy, Strict-Transport-Security on HTTPS, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy, Permissions-Policy, and a CORS wildcard.
- Set-Cookie flags when a cookie is present: Secure, HttpOnly, and SameSite.
- A noindex robots meta tag or X-Robots-Tag, the page title, and the meta description.
- Whether /robots.txt and /sitemap.xml exist and are not the HTML app shell.
- Up to 25 same-origin links on the homepage, a few at a time.
- One request each for /.env, /.env.local, /.env.production, /.git/HEAD, and /.git/config.
- Secret shapes in that public code: live and test Stripe secret keys, Stripe webhook secrets, OpenAI and Anthropic keys, AWS access key ids, GitHub and Slack tokens, Supabase service_role JWTs, and private keys. A Stripe publishable key and a Supabase anon key are noted as public on purpose.
What it does not check
- It does not log in, try passwords, brute-force paths, or query a database.
- It does not read third-party scripts, your Git host, or the builder's project files. If a secret never shipped in the public response, this scan will not see it.
- Supabase Row Level Security and Firebase security rules are not checked. Those stay listed as coming soon until you can prove you own the domain.
What to do with the result
- A value in a client bundle is visible to anyone who loads the app. Server-only environment variables should stay on the server. If the browser downloads it, rolling the key is the safe next step.
- An HTML page returned for /.env is not treated as a leaked env file. A real env file, with assignment lines, is.
Questions
Does this open my Lovable project?
No. The scan requests the public URL only. It does not sign into Lovable or read the chat that built the app.
Will it find a key that never left Lovable's editor?
No. If the key is not in the HTML, a same-origin script, or one of the five paths we request, it is outside this scan.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.