I Scanned 50 Lovable Apps — Here's What I Found

Lovable is one of the most popular AI coding platforms, with thousands of apps shipped every week. But how secure are they?

We decided to find out. We scanned 50 real Lovable apps currently live on the internet using ScanVibe's 8-point security analyzer. The results are... concerning.

Methodology

We collected 50 publicly accessible apps built with Lovable from:

• Lovable's showcase and community gallery
• Twitter/X posts tagged with #builtwithlovable
• Product Hunt launches mentioning Lovable
• Reddit posts on r/lovable and r/webdev

Each app was scanned using ScanVibe's full security suite, which checks: SSL/TLS, security headers, exposed secrets, JavaScript libraries, exposed files, Supabase configuration, Firebase configuration, and authentication endpoints.

We only scanned publicly accessible URLs. No login credentials were used, and no data was modified.

The Results at a Glance

The 5 Most Common Vulnerabilities

1. Missing Supabase Row Level Security — 78% of apps

This is the single biggest security issue in the Lovable ecosystem. 39 out of 50 apps had at least one Supabase table without RLS enabled.

Without RLS, anyone who knows your Supabase URL and anon key (which is in the client-side code by design) can read, modify, or delete all data in those tables. User data, payment information, private messages — all exposed.

2. Missing Security Headers — 74% of apps

37 apps were missing critical security headers like Content-Security-Policy, X-Frame-Options, and Strict-Transport-Security.

Without these headers, apps are vulnerable to cross-site scripting (XSS), clickjacking, and man-in-the-middle attacks.

3. Exposed API Keys in Source Code — 62% of apps

31 apps had at least one API key visible in the client-side JavaScript bundle. While Supabase anon keys are designed to be public (when RLS is enabled), we also found:

These keys can be extracted in seconds using browser DevTools.

4. Outdated JavaScript Libraries — 56% of apps

28 apps used JavaScript packages with known security vulnerabilities (CVEs). The most common:

• Outdated versions of next with known XSS vulnerabilities
• Vulnerable versions of postcss and webpack
• Unmaintained packages with no security patches

5. Weak Authentication Setup — 44% of apps

22 apps with authentication had issues:

• No rate limiting on login endpoints (18 apps)
• No email verification required (15 apps)
• Permissive password requirements (12 apps)
• Missing CSRF protection (8 apps)

Score Distribution

Here's how the 50 apps scored on our A-F scale:

The 3 Apps That Got It Right

Three apps stood out with good security practices. What did they have in common?

The takeaway: vibe-coded apps can be secure, but it requires intentional security work after generation.

What This Means for Lovable Users

If you've built an app with Lovable, chances are it has security issues. Here's what to do:

Immediate Actions (5 minutes)

1. Scan your app with ScanVibe — it's free and takes 30 seconds
2. Check your security grade and review the findings
3. If you see "Missing RLS" — this is your #1 priority

Priority Fixes (30 minutes)

1. Enable RLS on all Supabase tables — go to your Supabase dashboard, navigate to each table, and enable RLS
2. Add security headers — create a vercel.json with security headers (see our fix instructions)
3. Move secret keys to environment variables — never put secret keys in client-side code

Ongoing Protection

1. Set up weekly security scans
2. Re-scan after every major update
3. Review AI-generated code for security patterns before deploying

A Note to the Lovable Team

We want to be clear: Lovable is an incredible product. It's democratizing software development and enabling people to build apps that were previously impossible without a development team.

But with great power comes great responsibility. We'd love to see:

• RLS enabled by default on new Supabase tables
• Security headers included in default deployment configurations
• A security checklist in the deployment flow
• Integration with security scanning tools (like ScanVibe) before go-live

We're reaching out to Lovable's team to discuss how we can help their users build more secure apps.

Scan Your Lovable App Now

Don't be one of the 84%. Scan your app for free with ScanVibe and find out your security grade in 30 seconds.

Your AI built it. We check if it's safe.

Methodology note: This study was conducted in March 2026. All apps were publicly accessible at the time of scanning. We did not attempt to exploit any vulnerability. Apps were selected based on public availability, not to target specific developers. Individual scan results were not published to protect app owners.