AI App Launch Audit · Fixed price, quoted up front
Lovable App Security Audit
Lovable gets you from idea to working app remarkably fast. Before real customers and real data arrive, our senior Brisbane-led team checks what Lovable can’t fully check for you: your database rules, your edge functions, your sign-in flows, and what your app gives away to anyone who opens the browser console.
Fixed price, quoted up front
Free 30-minute engineer chat
Lovable Cloud and Supabase rules tested
Edge functions and secrets reviewed
Senior human review, not another scan
We fix it, then check again
Where the risks are
Where Lovable apps go wrong before launch
Lovable apps run on Supabase, either through Lovable Cloud, the built-in backend, or a Supabase project you connect yourself. It’s a solid stack. The risks are in how it’s configured for your app, and AI-generated configuration is easy to get almost right.
Database access
Row level security that’s on, but wrong
Every table should have row level security (RLS) switched on, and Lovable’s publish scan checks for that. But a policy can exist and still be wrong. A rule that lets any signed-in user read every customer’s records passes an “RLS enabled” check and leaks data anyway. We read every policy against who should really see what.
The public key
What your anon key can actually reach
Your Supabase URL and anon key ship to every visitor’s browser by design. That’s fine only if the rules behind them are right. We test your app with the same public key an attacker would use, table by table and role by role.
Edge functions
Server code anyone can call
Edge functions can use the service role key, which bypasses RLS entirely. If a function doesn’t check who is calling, anyone who finds its URL can borrow those powers. We review each function’s auth checks, input validation and rate limits.
Secrets
Keys in the wrong place
Lovable keeps secrets encrypted and out of the browser, and warns when you paste a key into chat. Problems start when a key slips into frontend code during a hurried iteration. We search your source and your built app for anything that shouldn’t be public.
Storage
Public buckets and guessable files
Uploaded documents, photos and invoices sit in storage buckets with their own access rules. A public bucket, or a policy that doesn’t check ownership, can expose every file. We check each bucket against what its files should be.
Sign-in and roles
Auth flows that only look finished
Sign-up, password reset, roles and admin screens are where business rules hide. We test whether a normal user can reach admin data, change someone else’s records or skip a step by calling the API directly.
Scans vs an audit
Lovable’s security scans are a great start. Here’s what an audit adds.
Lovable runs a Quick scan on every publish and offers an on-demand Deep scan of your code. Its own security documentation says these tools “cannot guarantee complete security” and recommends a professional review for apps handling sensitive data. That’s the gap we fill.
Built in
Lovable’s Quick and Deep scans
Automated checks inside Lovable. Run them, and fix what they find, before you book anything.
- Quick scan on every publish: database rules, tables without per-record access control, dependency vulnerabilities
- Deep scan on demand: access control, unauthenticated endpoints, injection, leaked secrets
- Auto-fix for Quick scan findings
- Fast and free to run, so use them often
Human review
AI App Launch Audit
Senior engineers test your app the way an attacker, and a real customer, would.
- Every RLS policy checked for correctness, not just existence
- Live testing with your public key and each user role
- Business rules: prices, roles, approvals and multi-step flows
- Performance, error handling and data integrity, not just security
- Plain-English report, fixes or fix prompts, and a re-test
New to this? Start with our pre-launch checklist for vibe-coded apps, or read about the AI App Launch Audit for every platform.
Why it matters
Why database rules get so much attention
In 2025, security researcher Matt Palmer reported scanning 1,645 Lovable-built projects and finding 303 insecure endpoints across 170 of them, caused by insufficient row level security policies (CVE-2025-48757). The CVE record has since been marked as disputed, and Lovable has added security scanning since.
The lesson applies to any Supabase-backed app, whoever built it: your database is reachable from the browser, so its rules are the only thing standing between your users’ data and the internet. That’s why an audit starts there.
Checklist
Lovable pre-launch security checklist
Run through these before you share your app with real customers. If any answer is “not sure”, that’s exactly what the audit is for.
Data and database
- RLS is enabled on every table that holds your app’s data
- No policy on private data uses
USING (true)or lets any signed-in user read every row - Read and write policies compare the row’s owner to
auth.uid(), or check a role - Private storage buckets aren’t public, and their policies check ownership
- Database functions that change data check who is calling
- Seed data, demo accounts and test users are removed before launch
Code, secrets and sign-in
- The service role key and third-party API keys live only in Secrets, never in frontend code
- Every edge function checks the caller’s session before doing anything sensitive
- Admin pages are protected on the server, not just hidden from the menu
- Email confirmation, password reset and leaked password protection are set up
- Forms, uploads and AI features validate input and are rate limited
- You’ve run Lovable’s Deep scan and resolved what it found
Want the reasoning behind each item? Our vibe-coded app checklist explains the risks in plain English.
How it works
How a Lovable app audit works
You don’t need to hand over your Lovable login. Usually a GitHub connection, a link to your app and a few test accounts are all we need.
01
Connect and scope
You share read access to the GitHub repository Lovable syncs your code to, a link to the app and a test account for each user role. We agree the scope and confirm the fixed price.
02
Test it like an attacker
We review every table, policy, edge function and storage bucket, then probe your app with the public key and each role, looking for anything one user shouldn’t see or change.
03
Review it like an engineer
Beyond security, we check code structure, error handling and performance on realistic data volumes, plus anything that will make your next round of prompts harder.
04
Report, fix and re-test
You get a plain-English report ranked by severity. We fix the issues, or give you precise prompts to fix them in Lovable yourself, then re-test before you launch.
Pricing
What a Lovable app audit costs
Fixed price, agreed in writing before we start. No hourly billing and no surprise invoices.
Free consultation
Start here
$0
30 minutes with an engineer
Tell us what you’ve built in Lovable, who will use it and what data it holds. We’ll tell you honestly whether it needs an audit yet.
- No pitch, no obligation
- Mutual NDA on request
- A clear next step either way
Fixed price
AI App Launch Audit
Scoped to your app
Quoted
fixed price, agreed before we start
A senior review of your Lovable app’s security, data access, code quality and launch readiness.
- Every database rule, function and secret reviewed
- Live testing with real user roles
- Plain-English report ranked by severity
- Re-test after fixes
Fixes and launch support
After the audit
Quoted
based on the audit findings
We fix what the audit finds, or coach you through fixing it with your own prompts, then help you launch.
- Quoted against the findings
- You choose what we fix
- Help with hosting and go-live
All prices in AUD. The audit price depends on the size of your app and is confirmed before any work starts. Still building and want ongoing help instead? See the AI Build Partner, a separate monthly product.
FAQ
Lovable app audit questions
Lovable says my app passed its security scan. Do I still need an audit?
If your app stores personal information, payments or business data, yes. The Quick scan checks a fixed set of settings, and Lovable itself says its tools can’t guarantee complete security. An audit checks whether each rule is right for your app, tests the live app with real roles, and covers business logic no scanner can know about.
Is it a problem that my Supabase anon key is visible in the browser?
Not on its own. The anon key is designed to be public, and your database rules decide what it can reach. It becomes a problem when those rules are missing or too generous. The service role key is different: it must never appear in your frontend code.
Do you need access to my Lovable account?
No. We work from read access to your GitHub repository, your app’s URL and test accounts for each role. For the database, a read-only view or your SQL migrations are usually enough. Anything else we need, we’ll ask for specifically.
Can you audit apps on Lovable Cloud as well as ones connected to my own Supabase project?
Yes. Both run on the Supabase stack, so the same risks apply. The difference is where some settings live, and we’ll confirm which setup you have during scoping.
Will you move my app off Lovable?
No. We fix issues in a way that keeps working with Lovable, or give you prompts to fix them yourself, so you can keep building the way you like. If you ever outgrow it, we can talk about options then.
Does the audit cover the Australian Privacy Act?
We check how your app collects, stores and protects personal information against the Australian Privacy Principles, including security of personal information, and flag where your data is stored and processed.
How much does a Lovable app audit cost?
It’s a fixed price, quoted for your app. The price depends on the size of your app and is agreed before we start. The free 30-minute consultation is a good way to find out where you stand first.
Can you keep an eye on the app after launch?
Yes, through a separate product. If you're still prompting new features into your app with Lovable, our AI Build Partner puts an engineer across it on a steady rhythm: they review what changed, build and fix alongside you, and release it to production monthly or fortnightly. Plans start at $1,800 a month ex. GST, with a three-month initial term and then month to month. The audit fee isn't credited against a plan; they're separate products for different needs.
Built with something else?
AI App Launch Audits for every platform
The risks differ from tool to tool, so each audit starts with how your platform really works.
Launch your Lovable app with confidence.
Book a free 30-minute chat with an engineer. Bring your app link and what it does, and we’ll tell you honestly what it needs before real customers arrive.
