GUIDE

Is my Lovable app secure? The 20-minute check

The three failures that actually burn AI-built apps are all checkable in about twenty minutes, without reading code. Run them before you share your link anywhere.

1. Can users see each other's data?

This is the most common serious failure in prompt-built apps, and Lovable's security toggle does not guarantee it's handled; that requires your database's own rules to be right. Test it directly: create two accounts, log in as the first, then ask your AI:

Write me a small script that uses my app's Supabase URL and anon key to try reading every table while logged in as this test user. Tell me if it can see rows belonging to other users.

If it can, ask your builder to add row-level security policies to every table, then run the same test again. Don't accept "done" without the re-test.

2. Did any secret keys ship to the browser?

Open your live site, view the page source, and search the page and its script files for sk_live, service_role and AKIA. Two very different outcomes:

Fine: your Supabase anon key or a Stripe key starting pk_live. These are designed to be public.
Emergency: a service_role key, a Stripe key starting sk_live, or an AWS key starting AKIA. Rotate the key at its source first (Stripe dashboard, Supabase settings, AWS console), then remove it from the app. Rotation first: removing it from the page doesn't help while the old key still works.

3. Are your admin pages actually locked?

Log out. Open a private browser window. Go directly to /admin, and any dashboard or settings pages your app has. If anything loads without asking you to sign in, tell your AI which page and ask it to require a login there, then re-check the same way.

Pass all three and you're ahead of most launches in this space. This checklist catches the common, serious mistakes. It's a first line of defense, not a professional audit, and it's honest to know the difference.

Check #2 has a free automated version: paste your link into the key-leak scanner and get the report in seconds. Plyo runs the same check automatically before every publish. The manual version above is free and always will be.

Plyo is the home for AI-built projects — every version saved, one click to undo, one click to publish, plus a safety check, visitor counts and backups. Free to start: 3 projects, no card needed.

Give your project a home