Free
€0
- Public surface (HTTPS, headers, code exposure)
- Configuration
- Real access between accounts
- Role bypass
- Sensitive integrations (payment, data)
- Tested by an expert
Security audit for Lovable and Supabase applications
Can your tables be read without signing in? Can one customer read another customer's orders? I check before an attacker does.
Request my auditLovable Expert, L5 Diamond level · Fortinet NSE 3 · OWASP method
What the Crissy Field study showed
Across 159,041 Lovable projects analyzed between December 2025 and September 2026, 24,664 sites send data from their database as soon as the page opens, with no sign-in. Email addresses were found in 10,560 tables, on 7,403 of those sites.
Lovable's scan and the audit: two levels
| Lovable security scan (free, on every publish) | Hands-on audit |
|---|---|
| Reads the code and configuration | Tests the running application |
| Flags tables without RLS and overly permissive rules | Checks that one account never reads another's data |
| Works without test accounts | Uses two test accounts with different roles |
| A list of alerts | A prioritized report with evidence and fixes |
What I test
RLS rules, table by table
Read, insert, update and delete without signing in.
Cross-account access
A customer, a seller or a courier only sees their own rows.
Role bypass
A standard user never gains admin rights.
Server functions (edge functions)
No sensitive action without authentication.
File storage
No private document reachable through a direct link.
Keys and secrets
The service_role key never appears in the code sent to the browser.
OWASP methodMozilla Observatory scoringLovable Expert, L5 Diamond levelFortinet NSE 3 (Cybersecurity)
What you receive
An expert report: every flaw proven, its severity and the steps to take, ranked by priority.
A document to show your clients, partners and investors: proof that you take security seriously.
Results within 5 business days: an in-depth analysis, not an instant scan.
Audit options
Express diagnostic
€490excl. VAT
- Public surface (HTTPS, headers, code exposure)
- Configuration
- Real access between accounts
- Role bypass
- Sensitive integrations (payment, data)
- Tested by an expert
Hands-on audit
from €1,499excl. VAT
- Public surface (HTTPS, headers, code exposure)
- Configuration
- Real access between accounts
- Role bypass
- Sensitive integrations (payment, data)
- Tested by an expert
Final price depends on the number of roles and integrations.
Audit carried out remotely, in France and internationally.
An access flaw costs far more than an audit: exposed data, lost customers, GDPR obligations. The audit prevents it.
Request my auditFrequently asked questions
Is Lovable's security scan enough?
It's a useful first barrier you should never ignore. It analyzes the code and configuration without testing the running application. It doesn't check whether a signed-in customer can read another customer's data.
My Supabase key is visible in the browser. Is that a problem?
The public (anon) key is meant to be visible. What protects your data is the RLS rules on each table. The service_role key, on the other hand, must never appear in the browser.
What is RLS?
Row Level Security: rules defined table by table that decide who can read or change each row. Without them, anyone holding the public key can read the table.
Does this apply to Lovable Cloud?
Lovable Cloud runs on Supabase: the same access rules apply and are checked the same way.
How much does an audit cost?
Express diagnostic at €490 excl. VAT, with a short report within 72 hours. Hands-on audit from €1,499 excl. VAT, depending on the number of roles and integrations.
What do I need to provide?
Your application's address and, for the hands-on audit, two test accounts with different roles. Project access is optional: it's only needed if you want me to apply the fixes.