Is my Lovable or Bolt app secure? How to check

Lovable and Bolt get you from idea to a working app fast. They do not guarantee the app is safe to share. The most common problems are not exotic hacks. They are things anyone can see by opening your app in a browser: a secret key in the JavaScript, a database table anyone can read, or a file that should never have shipped.

Here is how to check, in the order that matters.

The quick answer

Your app is in reasonable shape if all of these are true:

• No secret keys appear in the code your browser downloads.
• Every Supabase table has Row Level Security turned on, with policies that limit each user to their own rows.
• A signed out visitor cannot read or change data they should not see.
• No config, backup or source map files are publicly reachable.

If you are not sure about any of them, keep reading, or run a free LeakCheck scan on your live URL. A scan takes about 10 to 30 seconds.

Comparing scanners? Read bleek alternative. For Supabase tables, see free Supabase RLS checker.

For the full pre-launch pass, use the Lovable and Bolt pre-launch security checklist.

1. Look for secret keys in the browser

Open your app, view the page source and the loaded JavaScript files, and search for words like secret, service_role, sk_live and api_key. Public keys such as the Supabase anon or publishable key are meant to be there. Secret keys are not. See Supabase anon key vs service role key and environment variables in Cursor, Bolt and Lovable. If you already found a Supabase key in the bundle or a repo, exposed Supabase key: what to do now tells you whether it needs rotating.

2. Check your database rules

If your app uses Supabase, open the Table Editor and confirm RLS is enabled on every table, then read each policy. A policy of using (true) lets anyone through. Follow the Supabase RLS checklist. On Lovable, where you read policies depends on the backend; see how to check Supabase RLS on a Lovable app. On Firebase, use the Firestore rules checklist.

3. Try it as a stranger

Open the app in a private window, signed out. Then sign in as a second test user. Try to load another user's records by changing an id in the URL or request. If it works, you have a broken access control problem. See IDOR in Next.js and Supabase.

4. Check for files that should not ship

Try paths like /.env, /.git/config and source maps on your live domain. They should return nothing.

5. Ask the tool, then verify

Ask Lovable or Bolt to review its own security using our security review prompt. Treat the answer as a lead, not a verdict. For what dedicated audit agents check and miss, see Cloudflare security audit skill and Strix on vibe-coded apps.

Let LeakCheck do the first pass

LeakCheck checks your live app the way a stranger would, using read only requests. It looks for shipped secrets, open Supabase or Firebase data and exposed files, and it can also check a public GitHub repo for leaked keys. It never asks for your code or secrets.

• LeakCheck Free: the first preview scan needs no account. You get your score, grade, and every finding by title. Sign in free (Google or email) for more scans, full details and a fix prompt for the top 2, a Markdown report, and a README badge.
• LeakCheck Pro: $15 USD a month or $144 USD a year (CA$20 a month in Canada). Full details and a fix prompt for every finding, up to 3 watched apps, a rescan seconds after every deploy, daily, weekly or monthly rescans, and alerts by email, Slack or Discord when something gets worse.

Every new AI edit can bring back a problem you already fixed. That is what Pro's rescan after every deploy is for.

Check yours now

Find out what a stranger can see in your app. Run a free LeakCheck scan. When you ship often, LeakCheck Pro keeps checking after every deploy.