Most Lovable apps quietly leak their database.
Lovable builds on Supabase, and Supabase ships with row level security switched off. Your app works fine in preview, and in production anyone can read your tables. We check yours in under 30 seconds, then click through your app to see what else is broken.
We scanned 8 live Lovable apps that people shared publicly. 5 had a database table anyone could read without logging in, 2 of those leaked real user data (emails and invite tokens), and 4 had no analytics at all.
Free while in beta. I am collecting data on how AI-built apps break,
that is the trade. No signup, no card, no upsell at the end.
Is this safe to run?
- We open your app in a real browser and use it the way a visitor would: we press a few buttons and open a few screens.
- We never submit a form, never type into a field, and never touch anything that deletes, logs out, pays, or accepts terms. Nothing about your app is changed or stored.
- The database test runs only when you confirm the app is yours.
- Your report gets its own private link so you can bookmark or share it. It is not indexed by search engines, but anyone with the link can open it.
What we check
Does it work?
- We click your buttons and name the ones that do nothing
- We open your inner screens and flag the ones that come up empty
- No JavaScript errors breaking features
- Looks right on a phone, not just desktop
- Forms, links and images actually work
Is it safe?
- Your database is not readable by strangers (RLS)
- No secret API keys leaked in the code
- Basic security headers are in place
Is it ready?
- No leftover placeholder or demo text
- Title, favicon and social link previews set
- Analytics installed so you can see visitors
Loading your app in a real browser...
This usually takes 10 to 30 seconds. 0s