SniffPupSupabase RLS checker: how to check Row Level Security on every table
Check your Supabase Row Level Security: SQL to list tables with RLS off, how to test with your public anon key, and the policy mistakes (like using (true)) that leave data open.
Ember's case files
Security guides
Plain-English how-tos for apps built with Lovable, Bolt, Cursor and Supabase. Each guide walks you through checking one thing yourself, step by step. Only test sites you own.
How to find exposed API keys on your website
Check whether your live site leaks secret API keys: search your JavaScript bundles, test /.env and /.git paths, check source maps, and rotate anything you find.
Is my Lovable app secure? A practical checklist
Lovable's built-in scans help but don't replace a review. Check RLS on every table, keep secret keys out of the browser, and check what your published site exposes.
Want Ember to check for you?
The free scan looks at what your live site shows any visitor. It lists every issue it finds by title and severity, and shows the full details and the fix for the most serious one. The one-time $19 Full Fix Report unlocks the rest.
SniffPup checks what is publicly visible on your site. A clean report is not a guarantee of security.