Sample report

This is an example, not a real customer's app. It's real SniffPup output from scanning our own deliberately vulnerable demo app (demo-app.example). Every key in it is fake. It shows the full, unlocked $19 Full Fix Report; a free scan shows your score, every issue count and severity, and one finding explained in full.

Paste into Lovable chat:

My app leaks a Stripe secret key in front-end JavaScript that ships to the browser. Fix it:
1. Find every place the Stripe secret key is used in client-side code and remove it.
2. Move the calls that need it into a server-side function (API route / edge function / Supabase Edge Function) that reads it from an environment variable named STRIPE_SECRET_KEY.
3. Have the front end call that server function instead. Never expose STRIPE_SECRET_KEY via VITE_, NEXT_PUBLIC_ or similar public prefixes.
4. Make sure .env files are in .gitignore and are not deployed as static files.
5. Show me the list of files you changed.

Paste into Lovable chat:

My app leaks a OpenAI API key in front-end JavaScript that ships to the browser. Fix it:
1. Find every place the OpenAI API key is used in client-side code and remove it.
2. Move the calls that need it into a server-side function (API route / edge function / Supabase Edge Function) that reads it from an environment variable named OPENAI_API_KEY.
3. Have the front end call that server function instead. Never expose OPENAI_API_KEY via VITE_, NEXT_PUBLIC_ or similar public prefixes.
4. Make sure .env files are in .gitignore and are not deployed as static files.
5. Show me the list of files you changed.

Paste into Lovable chat:

My app ships the Supabase service_role key to the browser. This bypasses Row Level Security. Fix it:
1. Remove every use of the service_role key from client-side code. The browser client must use only the anon (publishable) key.
2. Move any admin operations that truly need service_role into a server-side function (Supabase Edge Function or API route) that reads SUPABASE_SERVICE_ROLE_KEY from environment variables.
3. Enable Row Level Security on every table and write policies so users can only read/write their own rows (e.g. auth.uid() = user_id).
4. List the files you changed and the SQL you ran.

Paste into Lovable chat:

My app leaks a GitHub token in front-end JavaScript that ships to the browser. Fix it:
1. Find every place the GitHub token is used in client-side code and remove it.
2. Move the calls that need it into a server-side function (API route / edge function / Supabase Edge Function) that reads it from an environment variable named GITHUB_TOKEN.
3. Have the front end call that server function instead. Never expose GITHUB_TOKEN via VITE_, NEXT_PUBLIC_ or similar public prefixes.
4. Make sure .env files are in .gitignore and are not deployed as static files.
5. Show me the list of files you changed.

Paste into Lovable chat:

My .env file is publicly downloadable from my deployed site. Fix it:
1. Make sure no .env* file is inside the public/static/build output folder.
2. Add .env* to .gitignore and to any deploy ignore file.
3. Add a rule so the host never serves dotfiles (paths starting with /.).
4. Use the hosting provider's environment variable settings instead of a committed .env file.
Show me what you changed.

Paste into Lovable chat:

My deployed site serves the /.git folder. Change the deploy so only the build output directory is published (not the repo root), and add a server/host rule that returns 404 for any path starting with /.git. Explain how to confirm the fix.

Paste into Lovable chat:

My deployed site serves the /.git folder. Change the deploy so only the build output directory is published (not the repo root), and add a server/host rule that returns 404 for any path starting with /.git. Explain how to confirm the fix.

Paste into Lovable chat:

Make my site always redirect http:// to https:// (permanent 308/301) and add a Strict-Transport-Security header. Use my hosting platform's settings or config file.

Paste into Lovable chat:

Turn off public source maps in my production build (e.g. Vite build.sourcemap = false, or Next.js productionBrowserSourceMaps = false). If I use an error tracker, configure hidden source maps uploaded privately instead.

Paste into Lovable chat:

Add these security response headers to every page of my deployed site: Content-Security-Policy; X-Frame-Options or CSP frame-ancestors (clickjacking); X-Content-Type-Options: nosniff; Referrer-Policy.
Use my hosting platform's config file. For Content-Security-Policy, start with a policy that allows my own scripts and the third-party services I actually use, and explain each directive. Show me the final config.

Paste into Lovable chat:

Find where my app sets cookies and make session/auth cookies Secure, HttpOnly and SameSite=Lax. Tell me which cookies must stay readable by JavaScript and why.

Paste into Lovable chat:

List every table in my Supabase project, tell me which ones have Row Level Security disabled, and write RLS policies so users can only access their own rows. Give me the SQL to run.

Paste into Lovable chat:

My public pages are client-side rendered, so Google and AI crawlers (GPTBot, ClaudeBot, PerplexityBot, which don't run JavaScript) see an empty page. Make the marketing pages (home, pricing, features, blog) render their text into the initial HTML using static generation or server-side rendering, keeping the app part as-is. Also add a <title>, meta description, one <h1>, JSON-LD for my organization/product, a sitemap.xml and an /llms.txt. Then show me how to verify with curl.

Paste into Lovable chat:

Add these SEO basics to my public pages, rendered in the initial HTML: Missing meta description; Missing <h1> in raw HTML. Write them based on what each page is about.

Paste into Lovable chat:

Update my robots.txt to allow GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot and PerplexityBot on public marketing pages while still blocking private/app routes. Show the final file.