Search
13 results for "lovable"
- Lovable security audit tool: how to audit your Lovable app for free
A step-by-step Lovable security audit with free tools: run Lovable's Quick and Deep scans in the Security view, fix Critical findings first, check your RLS policies signed out and as two users, keep keys in Secrets, then scan what your published URL shows a stranger.
- Pre-launch checklists: Supabase, Firebase, Vercel, Expo, Lovable, Bolt
Free, tick-as-you-go pre-launch checklists for Supabase, Firebase, Vercel, Expo / Rork, Lovable and Bolt. Every item links to the platform's own docs, and where SniffPup has a free check for it, to that check. Includes an interactive Supabase checklist.
- Safe-prompt pack: free security rules to paste into Lovable, Bolt, Cursor, Claude Code and Rork before you build
Copy-paste 'before you build' security rules for your AI builder: Lovable Knowledge, Bolt Knowledge, a Cursor .mdc rule, CLAUDE.md / AGENTS.md and Rork / Expo. They steer the AI away from leaked keys, open tables and missing server checks. Then scan your live app to see what actually shipped.
- Use SniffPup inside Lovable: add a free security scan to your Lovable chat (custom MCP connector)
Add SniffPup to Lovable as a custom MCP chat connector in about a minute: Connectors, Add custom, MCP server, paste https://sniffpup.com/api/mcp and pick No authentication. Then ask Lovable to scan the live site you own and fix what SniffPup finds. Free, no sign-in.
- Is my Lovable app secure? How to check it before you launch
Is your Lovable app secure? Not automatically. Check it in three steps: run Lovable's free Quick and Deep scans, test your Supabase data signed out, then scan what your published site shows a stranger.
- Lovable app security scanner (live URL)
Free passive scan of your published Lovable app's live URL: secret keys in JavaScript, public .env and .git files, Supabase key exposure and security headers. Pairs with Lovable's scans.
- Are VITE_ environment variables public? Yes. How to keep API keys out of your Vite, Lovable or Bolt frontend
Yes: every VITE_ variable (and every NEXT_PUBLIC_ or REACT_APP_ one) is copied into the JavaScript your visitors download. Publishable keys are fine there; secret keys are not. Move secrets to a server function, replace any key that already shipped, then check what your live site serves.
- I leaked an API key in my vibe-coded app. What do I do now?
A calm, step-by-step plan for when a Supabase service_role, OpenAI, Stripe or other secret key ends up in your Lovable, Bolt or Cursor app's JavaScript, a public .env file or GitHub: rotate first, check usage, move it server-side, then re-check your live site.
- Vibe-coded app security checklist: 14 checks before you launch
To check if your vibe-coded app is secure, test your live site, your database and your code. This checklist for Lovable, Bolt, Cursor, Replit and v0 apps covers leaked keys, Supabase RLS, storage buckets, API route auth, rate limits, webhook signatures and headers, with a test for each.
- Best free security scanners for vibe-coded apps (2026)
A neutral list of free security checks for Lovable, Bolt, Replit and Supabase apps: the builders' own scans first, then outside scanners including CheckVibe, GetLeaked, LeakPatrol, SafeToShip, SniffPup, Vibe App Scanner and VibePatrol. Facts checked Oct 26, 2026.
- Full fix report
Every fix with prompts for Lovable, Cursor, Bolt and Claude Code, plus 30 days of re-scans.
- AI rules file (Guardrails)
Turns your findings into a rules file for Cursor, Claude Code, Lovable or Bolt, so your AI helper is told not to repeat them. In the full fix report.
- Guides
Pre-launch checklists for Lovable, Bolt, Cursor, Replit and Supabase.