SniffPupLovable app security scanner (live URL)
Built your app with Lovable and published it? Paste the live URL below. SniffPup checks what your published site shows to anyone who visits it, passively and read-only.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Results cover your whole published site: secret keys, public files, Supabase key exposure and security headers. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
Start with Lovable's own scans
Lovable does a lot right here. Its Quick scan runs automatically every time you publish and checks your database access rules, dependencies and MCP server exposure. Its Deep scan reviews your application code for access-control, injection and leaked-secret problems. It also steers API keys into Secrets instead of your frontend code. It's a thoughtful setup: run both scans and fix every Critical finding first.
Lovable is also refreshingly honest about limits. Its security overview says:
“These tools support secure application development, but they do not replace a thorough security review.”
Lovable's scans run inside your project, during development and before publishing. SniffPup adds a different view: it checks the live site after it's published, from the outside, the way a stranger's browser sees it.
What this checks
- Secret keys in your shipped JavaScript, including Supabase
service_roleandsb_secret_keys and other secret API keys. Any key found is masked in the report. - Public files such as
/.env,/.git/configand public source maps. - Supabase in the browser: whether your site talks to Supabase and whether the public anon key is present (normal, shown as information).
- Security headers, cookie flags and HTTPS on the page you enter, plus whether your HTTPS certificate is valid and when it expires.
- Outdated JavaScript libraries with known vulnerabilities (the free scan shows the worst one in full).
What it can't tell you
- It can't see your code, your Lovable project or your Row Level Security policies. Lovable's scans and the Supabase RLS checker guide cover those.
- It doesn't log in, so pages behind sign-in aren't checked.
- It scans live web URLs only, not native mobile apps.
- A 100 score means no issues were found in our checks. It isn't proof of security.
A simple routine
- Run Lovable's Quick and Deep scans and fix the Critical findings.
- Publish, then scan the live URL here.
- Fix anything new, then scan again.
More: Is my Lovable app secure? A practical checklist and the best free security scanners for vibe-coded apps.
Questions
Lovable already scans my app. Why scan the live URL too?
Lovable's Quick scan runs automatically every time you publish, and its Deep scan reviews your application code. Those see your project from the inside. SniffPup looks at the published site from the outside, the way any visitor's browser does, so it checks what actually ships: the JavaScript bundles, public files and response headers. Running both gives you two views of the same app.
What does Lovable's documentation say about its own scans?
Lovable's security overview says its scans and connectors "support secure application development, but they do not replace a thorough security review." A live-site check is one more layer you can add.
Does SniffPup need access to my Lovable project or code?
No. You only enter your live URL. SniffPup never logs in, never sees your Lovable project and never uses a secret key it finds.
Does a 100 score mean my Lovable app is secure?
No. A 100 means no issues were found in our checks. It isn't proof of security, and the free scan can't see your Row Level Security policies.
Can it scan a native mobile app?
No. SniffPup scans live web URLs only, not native iOS or Android apps.