Guides

Practical checks you can run yourself. Each one says what the free scan can see, and what it cannot. Shorter notes on every check live on Checks.

• How to check if your Lovable app leaks your Supabase key (2-minute test)A two-minute browser test for a Lovable app: tell a Supabase anon key, which belongs in the page, from a service_role or sb_secret key that does not.
• Supabase RLS checker: find tables anyone can read (free)Find Supabase tables the anon key can read. Run two SQL queries and a logged-out GET, which is the same kind of read the free scan makes.
• Supabase service_role key exposed: what to do in the next 10 minutesA Supabase service_role JWT or sb_secret key in client code bypasses row-level security. Rotate that key, remove it from the bundle, and redeploy.