Is my Lovable app safe to launch?
Paste your address. We check your live Lovable app the way a stranger would, then tell you in plain English what could cost you money, and how to fix it.
Free. No sign-up. We check the one page you give us, and only what any visitor can already see.
Anyone on the internet can read your customer list.
Working is not the same as safe.
Lovable turns a description into a working web app, and it is one of the most popular tools for founders who do not write code. It is genuinely good at producing an app that looks and works right, which is the problem: nothing about a working app tells you which doors are open.
The faults we find in Lovable apps.
Written the way your own report would write them. These live in the app Lovable built for you, not in Lovable’s own service, which is why only a check of your app answers it.
Every customer can read every other customer's records.
Your master key is in the code every visitor downloads.
What this check cannot see.
Every scanner looks cleaner if it stays quiet about what it missed. We would rather tell you.
From outside we cannot see tables that are only reachable once someone is signed in. To check those we sign in as a test user, which needs you to prove the site is yours first. If a check could not run, your report says so in those words instead of showing a clean result you did not earn.
A real case, on the record.
In May 2025 researchers reported a pattern, tracked as CVE-2025-48757, in which 170 of 1,645 Lovable apps they scanned had databases a stranger could read or write, because of missing table rules. Lovable added warnings and checks in response. The fault was in the apps, not in Lovable’s own servers, which is exactly why a check of your own app is the only thing that tells you whether yours is one of them.
Source: CVE-2025-48757, reported by Matt Palmer and Matan Getz, May 2025
We scanned 25 Lovable apps.
Not a survey and not somebody else’s research. We read the code of 22 real apps strangers built with Lovable, and published how. The method is here.
- Had a key anybody reading the code could copy
- Taped to the front door: it can be used as though it were you.
- 12 of 22
- Had something a stranger could run up a bill on
- A part that costs money every time it runs, and runs for anybody who asks.
- 7 of 22
- Let a visitor’s typing reach too far
- Words typed into a box, treated as an instruction to follow.
- 9 of 22
You found something. Now what?
Almost all of this is settings rather than code. A table anybody can read is one rule away from being private, and Lovable will make the change if you tell it what to ask for. The hard part is never the fix, it is knowing which of your tables are wrong.
That is what the free check gives you: every open table, what is in it, and which ones actually matter. Paying gets you the sentence to paste back into Lovable, written for Lovable, and a re-check that tells you plainly whether it worked.
Fix it inside Lovable, without copying anything.
Connect us to Lovable once, and you never move between two windows again. You say “check my app and fix what you find” in Lovable itself, and it asks us directly: what is wrong, the exact wording to fix it, then a second check to prove it worked.
It reads, it does not write. We never touch your app ourselves. Lovable makes the change, with you watching.
Questions from people who built with Lovable.
- I used Lovable's own security review. Is this not the same thing?
- No, and they answer different questions. Lovable can tell you about the code it wrote. It cannot open your live app from outside, with no password, and try to read your customer table the way a stranger would. Ours is the second thing, and it is the one that says what is exposed right now.
- Does publishing from Lovable change what is exposed?
- It can. Publishing is what makes your app reachable by anybody, so a table with no rule on it goes from a private mistake to a public one at that moment. Nothing warns you, because from inside the app it behaves the same before and after.
- My app is on a lovable.app address rather than my own domain. Does that hide it?
- It does not. Those addresses are listed and searchable, and that is exactly how researchers found thousands of apps to study. An address nobody has told you about is not an address nobody can find.